CVE-2026-15325

Received Received - Intake

HTTP Request Smuggling in IBM WebSphere Application Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: IBM Corporation

Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-15325

EUVD

EUVD-2026-50022

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	9.0
ibm	websphere_application_server	8.5
ibm	websphere_application_server_liberty	From 17.0.0.3 (inc) to 26.0.0.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

IBM WebSphere Application Server versions 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to HTTP request smuggling due to improper handling of TRACE requests. This flaw allows attackers to manipulate HTTP requests, potentially bypassing security controls or accessing sensitive data.

Detection Guidance

Detecting HTTP request smuggling vulnerabilities like CVE-2026-15325 typically involves sending crafted TRACE requests and observing backend server behavior. Use tools like curl to send TRACE requests with unusual headers or chunked encoding. Monitor for inconsistent responses or errors that indicate the server may be vulnerable.

Impact Analysis

This vulnerability could allow attackers to smuggle malicious HTTP requests through the server, leading to unauthorized access, data breaches, or disruption of services. It may also enable attackers to bypass security measures like firewalls or authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Disable TRACE requests in IBM WebSphere Application Server configurations. Apply the latest security patches from IBM for versions 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.7. Monitor IBM security advisories for updates.

Hi! I’m here to help you understand CVE-2026-15325. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70