MEDIUM 6.5 NVD

CVE-2026-15396

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsin

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

References

https://www.ibm.com/support/pages/node/7286610

Published: 2026-09-14 · Source: NVD · Feed updated: 2026-09-15

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-14 via NVD.

vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.