VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/4xxx/CVE-2026-4410.json
T

170 lines
10 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-4410",
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"state": "PUBLISHED",
"assignerShortName": "ibm",
"dateReserved": "2026-03-19T02:14:15.887Z",
"datePublished": "2026-05-27T12:54:48.488Z",
"dateUpdated": "2026-05-27T15:25:09.833Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm",
"dateUpdated": "2026-05-27T12:54:48.488Z"
},
"title": "IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service",
"affected": [
{
"vendor": "IBM",
"product": "WebSphere Application Server - Liberty",
"versions": [
{
"status": "affected",
"version": "19.0.0.7",
"lessThanOrEqual": "26.0.0.5",
"versionType": "semver"
}
],
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server___liberty:19.0.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.5:*:*:*:*:*:*:*"
]
},
{
"vendor": "IBM",
"product": "WebSphere Application Server",
"versions": [
{
"status": "affected",
"version": "9.0"
},
{
"status": "affected",
"version": "8.5"
}
],
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:*"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.</p>"
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7273424",
"tags": [
"vendor-advisory",
"patch"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseSeverity": "MEDIUM",
"baseScore": 4.8,
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
}
],
"solutions": [
{
"lang": "en",
"value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70807 and APAR PH70616. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . \n\n\n\nFor IBM WebSphere Application Server Liberty 19.0.0.7 - 26.0.0.5 using the sipServlet-1.1 feature:\n\n\n\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH70807 https://www.ibm.com/support/pages/node/7273237 \n--OR--\n· Apply Fix Pack 26.0.0.6 or later (targeted availability 2Q2026).\n\n\n\n\n\nFor IBM WebSphere Application Server traditional:\n\n\n\nFor V9.0.0.0 through 9.0.5.27:\n· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH70616 https://www.ibm.com/support/pages/node/7269402 \n--OR--\n· Apply Fix Pack 9.0.5.28 or later (targeted availability 2Q2026).  \n\n\n\nFor V8.5.0.0 through 8.5.5.29:\n· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix that resolves PH70616 https://www.ibm.com/support/pages/node/7269402 \n--OR--\n· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).\n\n\n\n\n\n\n\nAdditional interim fixes may be available and linked off the interim fix download page.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70807 and APAR PH70616. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to <a href=\"https://www.ibm.com/support/pages/node/6553910\" rel=\"nofollow\">How to determine if Liberty is using a specific feature</a>.&nbsp;</p><div><p><strong>For IBM WebSphere Application Server Liberty 19.0.0.7 - 26.0.0.5 using the sipServlet-1.1 feature:</strong></p><p>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7273237\" rel=\"nofollow\">PH70807</a><br>--OR--<br>· Apply Fix Pack 26.0.0.6 or later (targeted availability 2Q2026).</p></div><p><strong>For IBM WebSphere Application Server traditional:</strong></p><p><strong>For V9.0.0.0 through 9.0.5.27:</strong><br>· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7269402\" rel=\"nofollow\">PH70616</a><br>--OR--<br>· Apply Fix Pack 9.0.5.28 or later (targeted availability 2Q2026).&nbsp;&nbsp;</p><p><strong>For V8.5.0.0 through 8.5.5.29:</strong><br>· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix that resolves <a href=\"https://www.ibm.com/support/pages/node/7269402\" rel=\"nofollow\">PH70616</a><br>--OR--<br>· Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026).</p><p></p><p>Additional interim fixes may be available and linked off the interim fix download page.</p>"
}
]
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-400",
"lang": "en",
"description": "CWE-400 Uncontrolled Resource Consumption"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-05-27T15:24:44.817386Z",
"id": "CVE-2026-4410",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-05-27T15:25:09.833Z"
}
}
]
}
}
View Git Blame Copy Permalink