CVE-2026-10841

MediumCVSS 6.5/10Last modified Nov 9, 2026

Description

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-444

Affected software

VendorProductVersions
IBMWebSphere Application Server9.0; 8.5
IBMWebSphere Application Server - Liberty>= 17.0.0.3, <= 26.0.0.5

References

Timeline

Published
Sep 18, 2026
Last modified
Nov 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1084105.5Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-1084118.8Heap-based buffer overflow in Windows ODBC Driver allows an unauthorized attacker to execute code over a network.CVE-2026-1084127.8Heap-based buffer overflow in Windows Redirected Drive Buffering allows an authorized attacker to elevate privileges locally.CVE-2026-1084137.0Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.CVE-2026-1084147.0Use after free in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1084156.8Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with CVE-2026-1084166.8Untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with CVE-2026-1084176.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-1084186.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-1084196.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-108427.5IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and LiberCVE-2026-1084217.5Out-of-bounds read in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-10841: Medium severity, CVSS 6.5 | Vulnix