Skip to content
Threat Feed
Subscribe
medium advisory

IBM WebSphere Application Server Liberty Denial of Service Vulnerability (CVE-2026-16192)

A denial of service vulnerability, CVE-2026-16192, affects IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 when the `restConnector-2.0` feature is enabled, allowing an unauthenticated attacker to cause service unavailability.

What's new

  • l2 added CVE-2026-14976 Jul 28, 21:26 via nvd

IBM has disclosed CVE-2026-16192, a denial of service vulnerability impacting IBM WebSphere Application Server - Liberty, specifically versions ranging from 17.0.0.3 up to and including 26.0.0.8. The vulnerability, classified as uncontrolled recursion (CWE-674), manifests when the restConnector-2.0 feature is enabled within the server configuration. While the specific mechanism of triggering the recursion is not detailed, an attacker with network access could send specially crafted requests to the server, exploiting this flaw to consume excessive resources and ultimately render the application server unresponsive. This vulnerability carries a CVSS v3.1 base score of 7.1 (High), indicating a significant impact on system availability if exploited. Defenders should prioritize patching or implementing mitigating controls to prevent service disruption.

Impact

Successful exploitation of CVE-2026-16192 leads to a denial of service (DoS) condition on the affected IBM WebSphere Application Server - Liberty instance. This means the server could become unresponsive or crash, severely disrupting the services and applications hosted on it. The unavailability of critical business applications can result in significant operational losses, reputational damage, and financial repercussions for organizations. The vulnerability specifically targets the availability of the system and does not mention data confidentiality or integrity being compromised.

Recommendation

  • Apply the latest security updates and patches provided by IBM for WebSphere Application Server - Liberty to address CVE-2026-16192. Refer to the IBM security bulletin referenced for specific patch details.
  • If immediate patching is not feasible, disable the restConnector-2.0 feature in your IBM WebSphere Application Server - Liberty configurations if it is not essential for operations. This mitigates the risk of exploitation for CVE-2026-16192.
  • Monitor IBM support pages for additional guidance or updated advisories related to CVE-2026-16192.