Skip to content
Threat Feed
Subscribe
high advisory

Denial of Service Vulnerability in IBM WebSphere Application Server - Liberty

A remote unauthenticated denial-of-service vulnerability in IBM WebSphere Application Server - Liberty allows attackers to cause excessive memory consumption via crafted requests.

What's new

  • l2 merged source coverage: CSRF to SSRF Vulnerability in IBM WebSphere Application Server Liberty Jul 30, 15:31 via nvd

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 contain a vulnerability identified as CVE-2026-11897. This issue is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling). A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted request to the application server. The vulnerability allows the attacker to trigger uncontrolled memory consumption, which may result in a denial-of-service condition, service instability, or system-wide resource exhaustion. This affects deployments of the Liberty profile across various environments, as the flaw resides within the request handling logic of the server. Defenders should identify vulnerable versions in their environment and prioritize applying patches provided by IBM to prevent resource exhaustion attacks.

Impact

The vulnerability poses a significant risk to availability. If successfully exploited, an attacker can crash the application server or degrade its performance, rendering it unavailable to legitimate users. The impact is primarily focused on the stability and uptime of enterprise applications running on the affected versions of the Liberty profile. Given the widespread use of WebSphere in enterprise environments, widespread or targeted exploitation could lead to significant business disruption.

Recommendation

  1. Identify all instances of IBM WebSphere Application Server - Liberty within the environment to confirm if they fall within the affected range (17.0.0.3 through 26.0.0.7).
  2. Apply the relevant security patches provided by IBM as documented in the vendor advisory (https://www.ibm.com/support/pages/node/7280695).
  3. Monitor web server and application logs for unusual request patterns, such as abnormally large payloads or repeated requests originating from a single source that correlate with memory spikes or process restarts.
  4. Implement rate limiting and request size limits at the load balancer or reverse proxy level to mitigate the impact of potentially malicious crafted requests.