CVE-2026-9336

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-306

Published

2026-09-10

Last modified

2026-09-10

Affected products

• IBM WebSphere Application Server
• IBM WebSphere Application Server

Weakness type

• CWE-306

Related vulnerabilities

• CVE-2026-88062 — OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
• CVE-2026-88018 — rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
• CVE-2026-88285 — GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service
• CVE-2026-49362 — Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
• CVE-2026-49363 — Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
• CVE-2026-49364 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
• CVE-2026-57967 — Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
• CVE-2026-67593 — Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

Markdown version · Browse all CVEs