HTTP Request Smuggling Vulnerability in IBM WebSphere Application Server
CVE-2026-10841

4.8MEDIUM

Key Information:

Vendor

IBM
Status
Websphere Application Server
Websphere Application Server - Liberty
Vendor
CVE Published:
18 September 2026

What is CVE-2026-10841?

IBM WebSphere Application Server versions 8.5, 9.0, and Liberty are susceptible to an HTTP request smuggling vulnerability. This flaw can potentially allow attackers to bypass security controls and manipulate the request handling process. By exploiting this vulnerability, an attacker may be able to interfere with the communication between clients and the server, leading to unauthorized access and data leakage. IBM proposes patches and updates to mitigate this issue.

Affected Version(s)

WebSphere Application Server 9.0

WebSphere Application Server 8.5

WebSphere Application Server - Liberty 17.0.0.3 <= 26.0.0.5

References

https://www.ibm.com/support/pages/node/7286610
vendor-advisorypatch
https://www.ibm.com/support/pages/node/7286611
vendor-advisorypatch

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.