Skip to content
OpenAdvisories
Medium WID-SEC-2026-3275 10 CVEs

IBM WebSphere Application Server Liberty: Mehrere Schwachstellen

Published Sep 8, 2026 · Updated Oct 12, 2026 · Revision 7 · de-DE

Vendor: IBM Product: Business Automation Workflow Product: i Product: Rational ClearQuest Product: SPSS Product: Tivoli Monitoring Product: TXSeries Product: WebSphere Application Server - Liberty Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und Informationen offenzulegen.

Product

IBM WebSphere Application Server Liberty ist ein leichter, dynamischer Anwendungsserver zur Entwicklung und Bereitstellung von Java-Anwendungen und Microservices.

Vulnerabilities 10

  • High 7.5
    CVE-2026-66142

    Apache Neethi: Uncontrolled recursion in policy processing

    Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to up…

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-66143

    Apache Neethi: Missing global alternative-output budget across policy computation paths

    It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to v…

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-66144

    Apache Neethi: Remote PolicyReference fetch lacks resource bounds

    Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes t…

    Apache Software Foundation Apache Neethi
  • Medium 6.5
    CVE-2026-11549

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-15396

    IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially cr…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-15412

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8  could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially craft…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2026-15634

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially cr…

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-10841

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-11548

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty
  • Medium 4.8
    CVE-2026-11722

    IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

    IBM WebSphere Application Server WebSphere Application Server - Liberty

Revision history

  1. #7

    Neue Updates von IBM aufgenommen

  2. #6

    Neue Updates von IBM aufgenommen

  3. #5

    Neue Updates von IBM aufgenommen

  4. #4

    Neue Updates von European Union Vulnerability Database und IBM aufgenommen

  5. #3

    Neue Updates von IBM aufgenommen

  6. #2

    Referenz(en) aufgenommen: EUVD-2026-78068, EUVD-2026-78067, EUVD-2026-78060

  7. #1

    Initiale Fassung

References