CVE-2026-9071

🗓️ 22 Jun 2026 14:47:39Reported by ibmType

CVE-2026-9071: IBM WebSphere Application Server and Liberty vulnerable to DoS from crafted requests causing memory exhaustion.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	2 Jul 202623:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	8 Jul 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	29 Jun 202613:12	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	27 Jul 202614:51	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty	16 Jul 202616:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities	18 Jun 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.	27 Jul 202617:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities have been identified in IBM WebSphere Application Server traditional, WebSphere Liberty profile, IBM HTTP Server its WebSphere plugins shipped with IBM Business Automation Workflow	18 Jun 202620:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)	3 Jul 202600:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is vulnerable to a denial of service	15 Jul 202611:51	–	ibm

NVD

Vulners

Node

AND

ibm websphere_application_serverRange8.5.0.0–8.5.5.30

ibm websphere_application_serverRange9.0.0.0–9.0.5.29

ibm websphere_application_serverRange17.0.0.3–26.0.0.7liberty

apple macosMatch-

ibm aixMatch-

ibm iMatch-

ibm z/osMatch-

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0",
        "lessThanOrEqual": "7.0.2 Interim Fix 035",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.5.0",
        "lessThanOrEqual": "7.0.3 Interim Fix 017",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
    ]
  },
  {
    "vendor": "IBM",
    "product": "WebSphere Application Server - Liberty",
    "versions": [
      {
        "status": "affected",
        "version": "17.0.0.3",
        "lessThanOrEqual": "26.0.0.6",
        "versionType": "semver"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server___liberty:17.0.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.6:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7276579

23 Jun 2026 20:46Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00549

SSVC

CWE-400