CVE Intelligence
Analysis AI-assisted

CVE-2026-8646: IBM WebSphere Application Server and Liberty HTTP Request Smuggling Vulnerability

IBM disclosed an HTTP request smuggling weakness (CWE-444) in WebSphere Application Server 8.5 and 9.0 and in WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6. The record describes a remote attacker who can smuggle a crafted request to bypass security controls, spoof identity, escalate privilege and expose sensitive information. No confirmed exploitation appears in the sources consulted, and the record lists no KEV entry.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

IBM has published a vendor advisory for an HTTP request smuggling weakness (CWE-444) affecting IBM WebSphere Application Server 8.5 and 9.0 and IBM WebSphere Application Server Liberty in the 17.0.0.3 through 26.0.0.6 range. Request smuggling occurs when a server and an intermediary parse the same HTTP message boundaries differently, so a crafted request can be interpreted in an unintended way.

Impact

The record states that a remote attacker could smuggle a specially crafted request to the application server. According to the record, this could allow the attacker to bypass security controls, spoof identity, escalate privilege and expose sensitive information. The CVSS 3.1 vector in the record indicates network attack vector, low complexity, no privileges required and no user interaction, with high confidentiality and integrity impact and no availability impact.

Affected products and versions

  • IBM WebSphere Application Server: 8.5.0.0 up to but not including 8.5.5.30
  • IBM WebSphere Application Server: 9.0.0.0 up to but not including 9.0.5.29
  • IBM WebSphere Application Server Liberty: 17.0.0.3 up to but not including 26.0.0.7

The record describes the Liberty range as 17.0.0.3 through 26.0.0.6 in its description, which is consistent with the upper boundary of 26.0.0.7 in the affected field.

Exploitation status

The CISA KEV catalog entry in the record is not listed. No confirmed active exploitation appears in the sources consulted for this record. EPSS and SSVC data are not available in the record.

Remediation and mitigation

  • Review the IBM vendor advisory at the link below and identify the fixed levels for your product line.
  • Plan to upgrade affected WebSphere Application Server and Liberty installations to levels outside the listed ranges. The record does not populate a fixes field, so confirm exact fixed builds with IBM.
  • Until patching is complete, limit exposure of affected servers and review how reverse proxies, load balancers and application servers handle request framing.
  • Validate that front-end and back-end components interpret request boundaries consistently after any configuration change.

Vendor advisory: IBM support page for this issue

Detection guidance

  • Review web server and proxy logs for requests with ambiguous or conflicting message framing headers, and for unexpected responses that suggest desynchronized request handling.
  • Monitor for sudden changes in access patterns, identity headers or privilege-related events on affected applications.
  • Correlate application logs with intermediary logs to detect mismatches in how requests were processed.

Limitations of the available information

  • The record does not include a populated fixes field, so fixed versions must be confirmed from the IBM advisory.
  • The NVD score is 9.1 while the IBM PSIRT score in the record is 7.4; both are CVSS 3.1 and come from different providers.
  • EPSS and SSVC values are null in the record.
  • The record has no title, so the title in this analysis was written from the product and weakness described.
  • The contents of the IBM advisory were not reviewed beyond the reference link in the record.

Frequently asked questions

What is the weakness in CVE-2026-8646?

The record classifies it as HTTP request smuggling under CWE-444, which can let crafted requests be interpreted in unintended ways by the application server.

Which IBM products and versions are affected?

The record lists WebSphere Application Server from 8.5.0.0 before 8.5.5.30 and from 9.0.0.0 before 9.0.5.29, plus Liberty from 17.0.0.3 before 26.0.0.7.

Is this vulnerability known to be exploited?

The record shows no KEV listing and no confirmed active exploitation in the sources consulted.

What should administrators do now?

Review the IBM advisory, confirm fixed builds with IBM, plan upgrades beyond the listed ranges and limit exposure until patching is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.