CVE-2026-15396: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditional 8.5to a version that resolves this vulnerability.Fixed in 8.5.5.31 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 9.0to a version that resolves this vulnerability.Fixed in 9.0.5.29Patch SB0030823
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to send a specially crafted HTTP request containing a transfer-encoding header to a vulnerable WebSphere Application Server or WebSphere Application Server Liberty deployment.
What impacts should teams investigate if they are exposed?
The vulnerability may allow HTTP request smuggling that can poison a web cache, bypass web application firewall protections, or enable XSS attacks. Teams should assess whether affected servers are deployed behind caches or WAFs and whether applications could be exposed to injected responses or scripts.