CVE-2026-103499

HighCVSS 7.5/10Last modified Oct 13, 2026

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-10353.1A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing re CVE-2026-1035006.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnera CVE-2026-1035019.8Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in CVE-2026-1035025.9Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm CVE-2026-1035035.9Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate f CVE-2026-1035048.1Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and CVE-2026-1035056.5Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3 CVE-2026-1035077.5Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding t CVE-2026-1035087.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a craf CVE-2026-1035098.5P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privile CVE-2026-1035109.5P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenti CVE-2026-1035115.1Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-use