CVE-2026-10571

Analyzed Analyzed - Analysis Complete

IBM WebSphere Liberty Insecure Deserialization DoS

Publication date: 2026-08-13

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-10571

EUVD

EUVD-2026-58359

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	websphere_application_server	From 17.0.0.3 (inc) to 26.0.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 caused by insecure deserialization. It allows a low-privileged administrative user to exploit the restConnector-2.0 feature and consume excessive system resources.

Detection Guidance

Check if the restConnector-2.0 feature is enabled in your IBM WebSphere Liberty installation. This can be done by reviewing server configuration files for the presence of the restConnector-2.0 feature.

Impact Analysis

The vulnerability could lead to system resource exhaustion, causing performance degradation or complete service disruption for affected IBM WebSphere Application Server Liberty instances.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt system availability. Unauthorized resource consumption may lead to service disruptions, potentially violating availability requirements in these regulations.

Mitigation Strategies

Apply the interim fix provided by IBM or upgrade to Liberty Fix Pack 26.0.0.9 or later. Ensure the restConnector-2.0 feature is disabled if not required.

Hi! I’m here to help you understand CVE-2026-10571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70