VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/10xxx/CVE-2026-10841.json
T

180 lines
8.5 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-10841",
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"state": "PUBLISHED",
"assignerShortName": "ibm",
"dateReserved": "2026-06-04T11:45:44.144Z",
"datePublished": "2026-09-18T16:06:43.195Z",
"dateUpdated": "2026-10-22T18:53:06.516Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm",
"dateUpdated": "2026-10-22T18:53:06.516Z"
},
"title": "IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "IBM",
"product": "WebSphere Application Server",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "8.5"
}
],
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
]
},
{
"vendor": "IBM",
"product": "WebSphere Application Server - Liberty",
"versions": [
{
"status": "affected",
"version": "17.0.0.3",
"lessThanOrEqual": "26.0.0.5",
"versionType": "semver"
}
],
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.8:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3&nbsp;through 26.0.0.8&nbsp;are vulnerable to HTTP request smuggling.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7286610",
"tags": [
"vendor-advisory",
"patch"
]
},
{
"url": "https://www.ibm.com/support/pages/node/7286611",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4.8,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.28:\n· Apply Fix Pack 9.0.5.29 https://www.ibm.com/support/pages/node/7285876 (availability September 2026) or later fix pack. \n\n\n\nFor V8.5.0.0 through 8.5.5.30:\n· Apply Fix Pack 8.5.5.31 https://www.ibm.com/support/pages/node/7285869 (availability September 2026) or later fix pack. \n\n\n\n\n\n\n\n\nFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8:\n· Apply Liberty Fix Pack 26.0.0.9 https://www.ibm.com/support/pages/node/7285875 (availability September 2026) or later fix pack.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.</p><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.28:</strong><br>· Apply Fix Pack <a href=\"https://www.ibm.com/support/pages/node/7285876\" rel=\"nofollow\">9.0.5.29</a> (availability September 2026) or later fix pack.&nbsp;</p><p><strong>For V8.5.0.0 through 8.5.5.30:</strong><br>· Apply Fix Pack <a href=\"https://www.ibm.com/support/pages/node/7285869\" rel=\"nofollow\">8.5.5.31</a> (availability September 2026) or later fix pack.&nbsp;</p><p><br></p><p><strong>For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.8:</strong><br>· Apply Liberty Fix Pack <a href=\"https://www.ibm.com/support/pages/node/7285875\" rel=\"nofollow\">26.0.0.9</a> (availability September 2026) or later fix pack.&nbsp;</p><div></div>"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-09-18T17:24:40.818522Z",
"id": "CVE-2026-10841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-18T17:24:50.263Z"
}
}
]
}
}
View Git Blame Copy Permalink