CVE-2026-15396: IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Other sources
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM WebSphere Application Server traditional 8.5to a version that resolves this vulnerability.Fixed in 8.5.5.31 - Upgrade
Upgrade
IBM WebSphere Application Server traditional 9.0to a version that resolves this vulnerability.Fixed in 9.0.5.29Patch SB0030823 - Upgrade
Upgrade
IBM WebSphere Application Server Libertyto a version that resolves this vulnerability.Fixed in 26.0.0.9
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to be able to send a specially crafted HTTP request containing a transfer-encoding header to a vulnerable WebSphere Application Server or WebSphere Application Server Liberty deployment.
What impacts should teams investigate if they are exposed?
The vulnerability may allow HTTP request smuggling that can poison a web cache, bypass web application firewall protections, or enable XSS attacks. Teams should assess whether affected servers are deployed behind caches or WAFs and whether applications could be exposed to injected responses or scripts.