Loading vulnerability…
Memory Resource Exhaustion in IBM WebSphere Application Server and Liberty
CVE-2026-9320 is an uncontrolled resource consumption vulnerability affecting IBM WebSphere Application Server 8.5 and 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6. A remote attacker can submit a specially crafted request that causes excessive server memory consumption and potentially denial of service. Liberty deployments are affected when specified servlet or WebSocket features are enabled. The vulnerable function and precise request-processing mechanism are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust server memory and render hosted applications or the application server unavailable. IBM assigns a CVSS v3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact without identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
IBM states that no workarounds or mitigations are available. As defense in depth pending patching, restrict network access to affected services to trusted clients and monitor abnormal memory consumption; these measures do not correct the vulnerability.
Patch, then assume compromise.
For WebSphere Liberty, upgrade to the minimum prerequisite fix-pack level and apply the interim fix for APAR PH71631, or install Fix Pack 26.0.0.7 or later. For WebSphere Application Server traditional 9.0.0.0 through 9.0.5.28, apply the interim fix for APAR PH71370 after meeting its prerequisites, or upgrade to 9.0.5.29 or later. For traditional 8.5.0.0 through 8.5.5.29, apply the corresponding PH71370 interim fix after meeting its prerequisites, or upgrade to 8.5.5.30 or later. For affected bundled deployments, upgrade HCL BigFix Compliance to 2.0.19 or later and HCL BigFix Inventory to 11.0.9.0 or later. Apply applicable IBM fixes directly to affected VersionVault or DevOps Code ClearCase CCRC WAN servers.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.