CVE-2026-15328 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling

Description

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

Affected products and versions

Product	Affected versions	Fixed in
WebSphere Application Server	9.0	No fix stated
WebSphere Application Server	8.5	No fix stated
WebSphere Application Server - Liberty 17.0	17.0.0.3 → 26.0.0.7	No fix stated

Other CVEs of WebSphere Application Server

The 185 CVEs of WebSphere Application Server →

CVE-2026-101294 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and… 8.7 High CVE-2026-105442 IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through… 7.5 High CVE-2026-93907 IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a… 8.1 High CVE-2026-95680 IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to… 8.0 High