CVE-2026-15634
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, cause…
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
Why it matters
- ▸ Remotely exploitable over the network — no physical or local access required
- ▸ Low attack complexity — no special conditions needed to exploit
- ▸ No authentication required
- ▸ No user interaction needed — can be exploited automatically
Apply the vendor patch as soon as it's available or already released.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
EU Vulnerability Database (ENISA)
EUVD is ENISA's EU vulnerability database, still in beta. EPSS is a probabilistic exploitation-likelihood score, not a certainty.
Stay Updated
New CVEs and vulnerability advisories are added continuously as they're disclosed. Subscribe via RSS to get every update the moment it's published — no email or account required.
Subscribe via RSS