CVE-2026-11897

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
IBMWebSphere Application Server - Liberty>= 17.0.0.3, <= 26.0.0.7

References

Timeline

Published
Jul 30, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1189756.5In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing CVE-2026-118984.4The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includinCVE-2026-1189836.8The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTMLCVE-2026-1189845.5OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys oCVE-2026-1189867.5CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs CVE-2026-1189875.3CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cCVE-2026-1189887.5CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. EverCVE-2026-1189895.5WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_fCVE-2026-118994.3The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all veCVE-2026-1189905.5CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration baCVE-2026-1189917.5CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backCVE-2026-1189928.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. resto