Denial of Service Vulnerability in IBM WebSphere Application Server - Liberty
CVE-2026-11897

7.5HIGH

Key Information:

Vendor

IBM
Status
Websphere Application Server - Liberty
Vendor
CVE Published:
30 July 2026

What is CVE-2026-11897?

IBM WebSphere Application Server - Liberty versions 17.0.0.3 to 26.0.0.7 are susceptible to a vulnerability that may lead to denial of service. An attacker can craft a specific request that, when received by the server, causes the system to exhaust its memory resources, potentially disrupting service. This issue necessitates immediate attention to protect applications from possible downtime and unavailability.

Affected Version(s)

WebSphere Application Server - Liberty 17.0.0.3 <= 26.0.0.7

References

https://www.ibm.com/support/pages/node/7280695
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was reported to IBM by the Okta Red Team.
.