CVE-2026-11710 PUBLISHED

IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

Assigner: ibm
Reserved: 08.06.2026 Published: 18.09.2026 Updated: 18.09.2026

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	WebSphere Application Server
Versions	Version 8.5 is affected

Solutions

IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71679.

For IBM WebSphere Application Server traditional:

For V8.5.0.0 through 8.5.5.30: · Apply Fix Pack 8.5.5.31 https://www.ibm.com/support/pages/node/7285869 (availability September 2026) or later fix pack.

Additional interim fixes may be available and linked off the interim fix download page.

References

https://www.ibm.com/support/pages/node/7286731

Problem Types

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE