CVE Intelligence
Analysis AI-assisted

CVE-2026-11541: IBM WebSphere Application Server and Liberty HTTP Request Smuggling

IBM published CVE-2026-11541 on 2026-06-30 for an HTTP request smuggling flaw (CWE-444) affecting IBM WebSphere Application Server and WebSphere Application Server Liberty. NVD rates it 9.8 Critical under CVSS 3.1, while IBM's own CVSS 3.1 score in the record is 7.4. The record does not list fixed versions, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM published a record for an HTTP request smuggling weakness (CWE-444) affecting IBM WebSphere Application Server and WebSphere Application Server Liberty. The CVE record was published on 2026-06-30 by IBM PSIRT as CNA. The only vendor reference in the record is the IBM support page.

Impact

  • HTTP request smuggling occurs when components that handle the same HTTP traffic interpret request boundaries differently, which can allow requests to be processed in an unintended way.
  • NVD scores the issue 9.8 (Critical) under CVSS 3.1, with network attack vector, no privileges required and no user interaction, and high impact to confidentiality, integrity and availability.
  • IBM's score in the record under CVSS 3.1 is 7.4. The two scores differ, and the record does not explain why.

Affected products and versions

  • The structured data lists IBM WebSphere Application Server with these ranges: 8.5.0.0 up to but below 8.5.5.31, 9.0.0.0 up to but below 9.0.5.29, and 17.0.0.3 through 26.0.0.6.
  • The description also names IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3 and 10.1. These products do not appear in the structured affected list, so their status must be confirmed with IBM.

Exploitation status

  • The record shows CISA KEV listing as false. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00417 (percentile 0.34212), dated 2026-10-13.

Remediation and mitigation

  • Compare installed WebSphere and Liberty levels against the ranges above and review the IBM bulletin.
  • The record contains no fixed versions. Confirm the available fix level directly with IBM before scheduling changes.
  • Until a fix is applied, review the reverse proxies and load balancers in front of these servers and make sure they parse and forward HTTP requests consistently.

Detection guidance

  • Watch for inconsistent handling of Content-Length and Transfer-Encoding headers between front-end components and application servers.
  • Review logs for unexpected back-end responses, signs of request desynchronization, and unusual request patterns on shared connections.

Limitations of the available information

  • The record does not include the text of the IBM bulletin, fixed versions, or technical details beyond the CWE classification.
  • The conflict between the product list in the description and the structured affected list is unresolved.
  • The two CVSS 3.1 scores differ and the reason is not stated.

Frequently asked questions

What is the core weakness in CVE-2026-11541?

The record classifies it as CWE-444, HTTP Request Smuggling, which occurs when components parse HTTP request boundaries differently.

Is there a confirmed fixed version?

The record lists no fixed versions. Check the IBM support page or contact IBM to confirm the fix level for your installed release.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.