DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM WebSphere Application Server Liberty: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-09-08
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server Liberty ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und Informationen offenzulegen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-11722US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-11549US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. | ||||
| CVE-2026-11548US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability. | ||||
| CVE-2026-10841US | medium4.8 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling. | ||||
| CVE-2026-15634US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper… | ||||
| CVE-2026-15412US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to conduct phishing attacks, u… | ||||
| CVE-2026-15396US | medium6.5 | — | ||
IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper… | ||||
| CVE-2026-66144US | — | — | ||
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy… | ||||
| CVE-2026-66143US | — | — | ||
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of… | ||||
| CVE-2026-66142US | — | — | ||
Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2026-3275 - CSAF Versionself
- WID-SEC-2026-3275 - Portal Versionself
- IBM Security Bulletin 7286611 vom 2026-09-08external
- IBM Security Bulletin 7286659 vom 2026-09-08external
- IBM Security Bulletin 7287332 vom 2026-09-15external
- IBM Security Bulletin 7287346 vom 2026-09-15external
- IBM Security Bulletin 7287665 vom 2026-09-15external
- IBM Security Bulletin 7288621 vom 2026-09-21external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan