Loading vulnerability…
HTTP Request Smuggling in IBM Web Server Plug-ins
CVE-2026-8620 is an HTTP request smuggling vulnerability in IBM Web Server Plug-ins for IBM WebSphere Application Server and WebSphere Liberty. The flaw affects deployments using the optional plug-in component in the 8.5 and 9.0 product lines. Inconsistent interpretation of malformed HTTP request framing by the plug-in and back-end application server can cause disagreement over request boundaries. Specially crafted requests with ambiguous, conflicting, or duplicate Content-Length and Transfer-Encoding headers may allow an attacker to smuggle a subsequent request through the plug-in to the back-end server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker may bypass the plug-in trust boundary and front-end security controls to cause a back-end application server to process an attacker-controlled smuggled request. This can enable security-control or WAF bypass, interference with downstream request handling, web-cache poisoning, and exposure of sensitive information. IBM assigned a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N), reflecting possible high confidentiality impact and limited integrity impact beyond the vulnerable plug-in's security authority.
If you can’t patch tonight, do this now.
No vendor-provided workaround or mitigation is available. Applying the IBM-provided interim fix or an updated fix pack is the confirmed remediation.
Patch, then assume compromise.
Apply IBM APAR PH71342 through the applicable Web Server Plug-ins interim fix or upgrade to a fix pack containing the fix. For the 9.0 line, affected versions 9.0.0.0 through 9.0.5.27 should be upgraded to the required prerequisite fix-pack level and patched with the PH71342 interim fix, or upgraded to Web Server Plug-ins 9.0.5.28 or later. For the 8.5 line, affected versions 8.5.0.0 through 8.5.5.29 should be upgraded to the required prerequisite fix-pack level and patched with the PH71342 interim fix, or upgraded to Web Server Plug-ins 8.5.5.30 or later. IBM identifies 9.0.5.24 and 8.5.5.25 as minimum levels for the respective interim-fix branches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.