Skip to content
OpenAdvisories
Medium WID-SEC-2026-4314 9 CVEs

IBM WebSphere Application Server Liberty: Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 9, 2026 · Revision 3 · de

Vendor: IBM Product: i Product: WebSphere Application Server - Liberty Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty ausnutzen, um einen Denial of Service Angriff durchzuführen, um falsche Informationen darzustellen und um Informationen offenzulegen.

Product

IBM WebSphere Application Server Liberty ist ein leichter, dynamischer Anwendungsserver zur Entwicklung und Bereitstellung von Java-Anwendungen und Microservices.

Vulnerabilities 9

  • High 7.5
    CVE-2026-91863

    Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

    A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-91864

    Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

    A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.…

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-91865

    Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

    A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, …

    Apache Software Foundation Apache Neethi
  • High 7.5
    CVE-2026-93879

    Hibernate Validator is affected by an expression language injection vulnerability

    Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.

    IBM Hibernate Validator libhibernate-validator-java libhibernate-validator-java Debian Ubuntu
  • Medium 6.5
    CVE-2026-108284

    IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.

    IBM WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2026-103320

    IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.

    IBM WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2026-10844

    IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks.

    IBM WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2026-11547

    IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.

    IBM WebSphere Application Server - Liberty
  • Medium 4.3
    CVE-2026-78636

    IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

    IBM WebSphere Application Server - Liberty

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-119687, EUVD-2026-119692, EUVD-2026-119620, EUVD-2026-119694, EUVD-2026-119739, EUVD-2026-119725

  3. #1

    Initiale Fassung

References