Loading vulnerability…
HTTP Request Smuggling in IBM WebSphere Application Server and Liberty
CVE-2026-8646 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server 8.5 and 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6. Inconsistent interpretation of HTTP request-length headers between an intermediary proxy or load balancer and the application server can allow a remote unauthenticated attacker to smuggle a specially crafted request. Successful exploitation can bypass security controls, spoof identities, escalate privileges, and expose sensitive information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality and integrity by allowing attacker-controlled requests to bypass security controls, impersonate identities, gain elevated privileges, and access sensitive information. The vulnerability-specific CVSS vector identifies high confidentiality and integrity impacts, with no direct availability impact.
If you can’t patch tonight, do this now.
IBM identifies no workaround or mitigation for the vulnerability. Pending patching, restrict access to affected application services to trusted networks as a defense-in-depth measure; access restrictions do not correct the request-parsing inconsistency and are not a substitute for installing the fix.
Patch, then assume compromise.
Apply the applicable IBM interim fix or a fix pack containing the correction. For WebSphere Liberty, upgrade to the minimum prerequisite fix-pack level and apply the interim fix for APAR PH71631, or install Fix Pack 26.0.0.7 or later. For traditional WebSphere Application Server 9.0.0.0 through 9.0.5.28, apply the interim fix for APAR PH71370 after meeting its prerequisites, or upgrade to 9.0.5.29 or later. For traditional WebSphere Application Server 8.5.0.0 through 8.5.5.29, apply the same APAR's applicable interim fix after meeting its prerequisites, or upgrade to 8.5.5.30 or later. For affected bundled deployments, upgrade HCL BigFix Compliance to 2.0.19 or later and HCL BigFix Inventory to 11.0.9.0 or later. Apply the appropriate IBM WebSphere fixes directly to affected HCL VersionVault or DevOps Code ClearCase CCRC WAN server hosts.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.