CVE-2026-4410

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-441009.4The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging CVE-2026-441019.8Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. CVE-2026-441025.3An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This w CVE-2026-441035.3An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits fi CVE-2026-441049.8The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature CVE-2026-441056.6The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access CVE-2026-441067.8A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary comman CVE-2026-441077.5A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enab CVE-2026-441089.8Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates CVE-2026-441099.8OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthent CVE-2026-441108.8OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing CVE-2026-441114.3OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read a