CVE-2026-15396: XSS
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to send a specially crafted HTTP request containing a transfer-encoding header to a vulnerable WebSphere Application Server or WebSphere Application Server Liberty deployment.
What impacts should teams investigate if they are exposed?
The vulnerability may allow HTTP request smuggling that can poison a web cache, bypass web application firewall protections, or enable XSS attacks. Teams should assess whether affected servers are deployed behind caches or WAFs and whether applications could be exposed to injected responses or scripts.