Loading vulnerability…
Memory-exhaustion denial of service in IBM WebSphere Application Server
CVE-2026-9071 is an uncontrolled resource consumption vulnerability affecting IBM WebSphere Application Server 8.5 and 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6. A remote, unauthenticated attacker can send a specially crafted HTTP request that causes excessive server memory consumption, potentially exhausting available memory and making hosted services unavailable. The vulnerability has a CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can exhaust application-server memory and cause denial of service, disrupting applications hosted by the affected server. No confidentiality or integrity impact is identified for this vulnerability.
If you can’t patch tonight, do this now.
IBM identifies no vendor-supported workaround or mitigation. Until fixes are installed, restrict network access to affected application services to trusted clients where feasible and monitor for anomalous memory consumption. These exposure-reduction measures do not eliminate the vulnerability.
Patch, then assume compromise.
For WebSphere Application Server Liberty, install the interim fix for APAR PH71631 after meeting its prerequisite fix-pack level, or upgrade to 26.0.0.7 or later. For traditional WebSphere Application Server 9.0.0.0 through 9.0.5.28, install the interim fix for APAR PH71370 after meeting its prerequisites, or upgrade to 9.0.5.29 or later. For traditional WebSphere Application Server 8.5.0.0 through 8.5.5.29, install the applicable PH71370 interim fix or upgrade to 8.5.5.30 or later. For affected bundled deployments, upgrade HCL BigFix Compliance to 2.0.19 or later or HCL BigFix Inventory to 11.0.9.0 or later, as applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.