Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty (bundled with IBM Enterprise Application Runtimes) are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Enterprise Application Runtimes, when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM WebSphere Application Server Liberty and IBM WebSphere Application Server shipped with IBM WebSphere Remote Server

Summary IBM WebSphere Application Server Liberty and IBM WebSphere Application Server are shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty and IBM WebSphere Application Server has been published in a security...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty (bundled with IBM Cloud Pak for Applications) are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities due to Apache CXF

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by multiple vulnerabilities due to Apache CXF CVE-2026-57819, CVE-2026-54225, CVE-2026-64958 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server and is affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary The security issue described in CVE-2026-57819, CVE-2026-54225 and CVE-2026-64958 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refer to the security bulletins listed in t...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server due to Apache CXF have been published in a security bulletin. Vulnerability Details Refer to the security...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

IBM WebSphere Application Server 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.9 (7283567)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7283567 advisory. - An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message...

CVE-2026-57819 Apache CXF: No default restriction on the amount of form parameters per message

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...