{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/websphere-application-server---liberty-17.0.0.3-through-26.0.0.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-103499"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WebSphere Application Server - Liberty (17.0.0.3 through 26.0.0.10)","WebSphere Application Server (8.5)","WebSphere Application Server (9.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","web-server"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM has identified a critical vulnerability, tracked as CVE-2026-103499, affecting multiple versions of the WebSphere Application Server and Liberty profile. The vulnerability arises from improper handling of resource management, specifically an uncontrolled resource consumption flaw. A remote, unauthenticated attacker can exploit this condition by sending specially crafted requests to the application server, leading to resource exhaustion. This impact effectively renders the service unresponsive to legitimate users, resulting in a denial-of-service (DoS) condition. The affected versions include Liberty 17.0.0.3 through 26.0.0.10, as well as IBM WebSphere Application Server versions 8.5 and 9.0. Defenders should prioritize identifying instances of these specific versions within their environment to mitigate the risk of service disruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in a denial-of-service, leading to the exhaustion of server resources such as CPU or memory. This impacts the availability of business-critical applications hosted on the affected IBM WebSphere platforms. Organizations utilizing these versions face the risk of service downtime and operational disruption from remote, unauthenticated threat actors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview the server versions in use to identify instances matching Liberty 17.0.0.3 through 26.0.0.10, or WebSphere Application Server 8.5 and 9.0.\u003c/li\u003e\n\u003cli\u003eApply the official security patches provided by IBM for CVE-2026-103499 as soon as they are made available to remediate the resource consumption flaw.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for spikes in request volume or abnormal request patterns targeted at the application server that may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T14:37:04Z","date_published":"2026-10-13T14:37:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ibm-websphere-dos/","summary":"IBM WebSphere Application Server and Liberty are susceptible to an unauthenticated remote denial-of-service attack via CVE-2026-103499, which permits uncontrolled resource consumption.","title":"IBM WebSphere Application Server Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-ibm-websphere-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - WebSphere Application Server - Liberty (17.0.0.3 Through 26.0.0.10)","version":"https://jsonfeed.org/version/1.1"}