CVE-2026-15064

Received Received - Intake

HTTP Response Smuggling in IBM WebSphere

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-15064

EUVD

EUVD-2026-50024

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	9.0
ibm	websphere_application_server	8.5
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server versions 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to HTTP Response Smuggling. This occurs because the server improperly handles non-standard HTTP version tokens, allowing attackers to manipulate responses and potentially bypass security controls.

Impact Analysis

This vulnerability could allow attackers to smuggle malicious HTTP responses, leading to cache poisoning, session hijacking, or unauthorized access to sensitive data. It may also enable bypassing security mechanisms like firewalls or intrusion detection systems.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Apply the latest IBM WebSphere Application Server or Liberty updates to versions beyond 26.0.0.7. Monitor IBM security advisories for patches and test updates in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-15064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70