CVE-2026-10841

MediumCVSS 4.8/10Last modified Oct 22, 2026

Description

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-444

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-108427.5IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and LiberCVE-2026-1084268.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084278.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084288.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084298.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-108437.2A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with accounCVE-2026-1084308.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084318.8Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084328.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1084337.8Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature loCVE-2026-1084346.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-1084356.5Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-10841: Medium severity, CVSS 4.8 | Vulnix