CVE-2026-8850: IBM HTTP Server is affected by multiple vulnerabilities
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module modibmupload.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM HTTP Server (IBM WebSphere Application Server)to a version that resolves this vulnerability.Fixed in 8.5.5.30 - Upgrade
Upgrade
IBM HTTP Server (IBM WebSphere Application Server)to a version that resolves this vulnerability.Fixed in 9.0.5.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PH71265 - Compensating control
For the vulnerable optional module mod_ibm_upload in IBM HTTP Server, disable/avoid using mod_ibm_upload until the interim fix or fix pack that contains the fix for APAR PH71265 is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8850?
The severity of CVE-2026-8850 is rated high with a score of 7.5.
How do I fix CVE-2026-8850?
To fix CVE-2026-8850, apply the currently available interim fix or fix pack that contains the fix for APAR PH71265.
What impact does CVE-2026-8850 have on IBM HTTP Server?
CVE-2026-8850 can lead to a denial of service in IBM HTTP Server through the mod_ibm_upload module.
Which versions of IBM HTTP Server are affected by CVE-2026-8850?
CVE-2026-8850 affects IBM HTTP Server versions 8.5 and 9.0.
Is there a workaround for CVE-2026-8850?
IBM recommends applying the available interim fix or wait for the upcoming fix pack as the main remediation for CVE-2026-8850.