CVE-2026-15057

Received Received - Intake

Denial of Service in IBM WebSphere Liberty

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-15057

EUVD

EUVD-2026-50025

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service attack due to uncontrolled heap allocation. This means an attacker could send specially crafted requests that cause the server to allocate excessive memory, leading to system slowdowns or crashes.

Impact Analysis

This vulnerability could allow an attacker to disrupt the availability of your IBM WebSphere Application Server Liberty instance. If exploited, it may cause the server to become unresponsive or crash, leading to downtime for applications relying on this server.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service, potentially leading to unauthorized data access or loss of availability for sensitive data processing.

Mitigation Strategies

Update IBM WebSphere Application Server - Liberty to version 26.0.0.8 or later to address the uncontrolled heap allocation vulnerability.

Hi! I’m here to help you understand CVE-2026-15057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70