Skip to content
OpenAdvisories
Medium WID-SEC-2026-4320 2 CVEs

IBM WebSphere Application Server: Mehrere Schwachstellen ermöglichen Denial of Service

Published Nov 3, 2026 · Updated Nov 5, 2026 · Revision 2 · de-DE

Vendor: IBM Product: Business Automation Workflow Product: WebSphere Application Server Product: WebSphere Service Registry and Repository Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

IBM WebSphere Application Server ist ein J2EE-Applikationsserver.

Vulnerabilities 2

  • High 7.5
    CVE-2026-91865

    Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

    A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, …

    Apache Software Foundation Apache Neethi
  • Medium 4.3
    CVE-2026-91867

    Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

    When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to u…

    Apache Software Foundation Apache Neethi

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References