CVE-2026-15064

HighCVSS 8.7/10Last modified Sep 23, 2026

Description

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
IBM	WebSphere Application Server	9.0; 8.5
IBM	WebSphere Application Server - Liberty	>= 17.0.0.3, <= 26.0.0.7

References

https://www.ibm.com/support/pages/node/7281625Vendor Advisory

Timeline

Published: Jul 28, 2026
Last modified: Sep 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-150659.1IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of inter CVE-2026-150666.4The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, a CVE-2026-150678.8Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized d CVE-2026-150689.9IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper CVE-2026-150695.4IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization CVE-2026-15077.5The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI service CVE-2026-150708.8The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin CVE-2026-150726.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parame CVE-2026-150736.5The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parame CVE-2026-150747.5@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution sta CVE-2026-150757.5In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al CVE-2026-150767.5In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does