IBM WebSphere Application Server Liberty DoS via Deserialization (CVE-2026-10571)

Vulnerability Overview Vulnerability Name: IBM WebSphere Application Server Liberty Denial of Service Vulnerability (CVE-2026-10571) Vulnerability Description: IBM WebSphere Application Server Liberty contains a denial of service vulnerability when using the feature. Low-privileged administrator users can exploit this vulnerability to consume system resources. CVE ID: CVE-2026-10571 CWE: CWE-502: Deserialization of Untrusted Data CVSS Base Score: 3.7 CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Affected Scope Affected Product: IBM WebSphere Application Server - Liberty Affected Versions: 17.0.0.3 - 26.0.0.8 Remediation Recommended Actions: IBM strongly advises applying the currently available interim fix or APAR DT497316 containing the fix immediately. Specific Steps: - For IBM WebSphere Application Server Liberty versions 17.0.0.3 - 26.0.0.8 that use the feature: - Upgrade to the minimum fix pack level required for the interim fix, and then apply the interim fix that resolves DT497316. - Alternatively, apply Liberty Fix Pack 26.0.0.9 or higher (Target Availability: Q3 2026). Additional Information: Additional interim fixes may be available and linked to the interim fix download page. Additional Information Workarounds and Mitigations: None Reference Links: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry standard designed to communicate the severity of a vulnerability and help determine response urgency and priority, according to the Forum of Incident Response and Security Teams (FIRST). IBM provides CVSS scores "as is" and makes no express or implied warranties. Customers are responsible for evaluating the actual or potential impact of the vulnerability on their products. IBM periodically updates vulnerability records in the product/service inventory, but citing an older CVE ID does not mean IBM has used that vulnerability since that date. Citing unsupported or extended support products and versions does not constitute IBM’s determination that those versions are not affected by the vulnerability. Citing one or more unsupported versions in this document does not create an obligation for IBM to provide a fix for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Application Server Liberty DoS via Deserialization (CVE-2026-10571)