CVE-2026-15634
Received Received - Intake

HTTP Request Smuggling in IBM WebSphere Application Server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15634

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ibm websphere_application_server 9.0
ibm websphere_application_server 8.5
ibm websphere_application_server_liberty *
ibm websphere_application_server to 9.0.5.29 (exc)
ibm websphere_application_server to 8.5.5.31 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an HTTP request smuggling issue in IBM WebSphere Application Server versions 9.0, 8.5, and Liberty. It occurs due to improper parsing of the HTTP transfer-encoding request header. An attacker can exploit this by sending a specially crafted header to poison web caches, bypass firewalls, or perform cross-site scripting (XSS) attacks.

Impact Analysis

This vulnerability could allow attackers to poison web caches, bypass security protections like firewalls, and execute XSS attacks. This may lead to data breaches, unauthorized access, or disruption of services relying on the affected WebSphere servers.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Compliance could be impacted if sensitive data is exposed or if security controls are bypassed due to the flaw.

Mitigation Strategies

Apply the latest Fix Pack for IBM WebSphere Application Server 9.0 (9.0.5.29 or later) or 8.5 (8.5.5.31 or later) as recommended by IBM to address the HTTP request smuggling vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart