CVE-2026-11541: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
Other sources
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.0.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.5.31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.5.29 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PH71706 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PH71808
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11541?
CVE-2026-11541 has a critical severity rating of 9.8.
How do I fix CVE-2026-11541?
To remediate CVE-2026-11541, update to the latest version of IBM WebSphere Application Server or Liberty as specified in the vendor's security advisory.
What systems are affected by CVE-2026-11541?
CVE-2026-11541 affects IBM WebSphere Application Server versions 8.5 and 9.0, along with IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.6.
What type of vulnerability is CVE-2026-11541?
CVE-2026-11541 is identified as an HTTP request smuggling vulnerability.
What impact does CVE-2026-11541 have on security?
The impact of CVE-2026-11541 includes potential unauthorized access to sensitive information and the ability to conduct further attacks based on the exploitation of the vulnerability.