IBM WebSphere Application Server DoS Vulnerability Advisory (CVE-2026-50645)

Vulnerability Overview IBM WebSphere Application Server and WebSphere Application Server Liberty have multiple vulnerabilities, including CVE-2026-50645, CVE-2026-9322, and CVE-2026-9171. These vulnerabilities may result in uncontrolled resource consumption and service denial. Affected Products Affected Products: - WebSphere Application Server 9.0 - WebSphere Application Server 8.5 - WebSphere Application Server - Liberty 17.0.0.3 - 26.0.0.7 Remediation IBM strongly recommends addressing the vulnerabilities by applying the currently available interim fixes or fix packs, which contain fixes for APAR PH71585 and PH71670. The specific steps are as follows: For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.7 (using jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features): Upgrade to the required interim fix level, and then apply the interim fix for PH71585. Alternatively, apply Fix Pack 26.0.0.8 or later (Target Availability: Q3 2026). For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.28: - Upgrade to the required interim fix level, and then apply the interim fix for PH71670. - Alternatively, apply Fix Pack 9.0.5.29 or later (Target Availability: Q3 2026). For V8.5.0.0 through 8.5.5.30: - Upgrade to the required interim fix level, and then apply the interim fix for PH71670. - Alternatively, apply Fix Pack 8.5.5.31 or later (Target Availability: Q3 2026). Additional Information Workarounds: None. References: - Complete CVSS v3 Specification - Online Calculator v3 Disclaimer The Common Vulnerability Scoring System (CVSS), as defined by the Forum of Incident Response and Security Teams (FIRST), is an industry standard intended to convey vulnerability severity and response priority. IBM provides the CVSS scoring "as is" and without any warranty, either express or implied. Customers are responsible for evaluating the impact of the vulnerability on their environment. IBM updates the product component records periodically but does not establish recognition of the vulnerability based on references to older CVE dates. The affected products and versions referenced in IBM security bulletins refer only to IBM supported and non-end-of-life products. Failure to reference unsupported or extended support products and versions does not constitute IBM’s obligation to provide fixes for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Application Server DoS Vulnerability Advisory (CVE-2026-50645)