CVE-2026-15396
Received Received - Intake

HTTP Request Smuggling in IBM WebSphere

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15396

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ibm websphere_application_server 9.0
ibm websphere_application_server 8.5
ibm websphere_application_server_liberty *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM WebSphere Application Server 9.0, 8.5, and Liberty are vulnerable to HTTP request smuggling due to improper parsing of the HTTP transfer-encoding request header. This flaw allows attackers to craft malicious requests that can poison web caches, bypass firewalls, and enable cross-site scripting (XSS) attacks.

Detection Guidance

Detecting HTTP request smuggling vulnerabilities like CVE-2026-15396 requires testing for improper parsing of the HTTP transfer-encoding header. Use tools like Burp Suite or curl to send malformed requests with conflicting transfer-encoding headers. Example curl command: curl -v -H 'Transfer-Encoding: chunked' -H 'Content-Length: 0' http://target.com. Monitor responses for inconsistencies or errors that indicate vulnerability.

Impact Analysis

This vulnerability could allow attackers to manipulate web traffic, leading to cache poisoning, bypassing security controls like firewalls, and executing XSS attacks. This may result in unauthorized access to sensitive data, defacement of websites, or further exploitation of user sessions.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised sensitive information.

Mitigation Strategies

Apply the latest IBM WebSphere Application Server or Liberty patches immediately. Disable HTTP request smuggling by configuring the server to reject malformed transfer-encoding headers. Monitor network traffic for unusual HTTP requests and update web application firewalls to block suspicious patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart