CVE-2026-11897

Undergoing Analysis Undergoing Analysis - In Progress

IBM WebSphere Liberty Denial of Service Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: IBM Corporation

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-11897

EUVD

EUVD-2026-51147

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7. It occurs when a specially crafted request is sent to the server, causing it to consume excessive memory resources.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory consumption or malformed requests targeting IBM WebSphere Liberty. Check server logs for repeated requests with abnormal payloads. Use network monitoring tools like tcpdump or Wireshark to capture suspicious traffic patterns. Inspect system memory usage for unexplained spikes.

Impact Analysis

A remote attacker could exploit this to make the server unresponsive or crash by consuming all available memory, leading to service disruption for legitimate users.

Compliance Impact

The vulnerability could lead to denial of service by consuming memory resources, potentially disrupting services handling sensitive data. This may impact compliance with GDPR (availability of personal data) and HIPAA (availability of protected health information) by causing service disruptions or data processing delays.

Mitigation Strategies

Update IBM WebSphere Application Server - Liberty to a version beyond 26.0.0.7 to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-11897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70