CVE-2024-22353: IBM WebSphere Application Server DOS

CVE-2024-22353 Overview

CVE-2024-22353 affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 24.0.0.4. The flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending a specially crafted request. Exploitation causes the server to consume excessive memory resources, degrading availability for legitimate users. IBM tracks this issue under X-Force ID 280400 and classifies it under [CWE-770: Allocation of Resources Without Limits or Throttling]. The vulnerability impacts availability only, with no effect on confidentiality or integrity.

Critical Impact

A remote attacker can exhaust server memory without authentication, causing service disruption on any exposed WebSphere Liberty instance.

Affected Products

• IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4
• Deployments using the Liberty profile across all supported operating systems
• Containerized and on-premises WebSphere Liberty workloads

Discovery Timeline

• 2024-03-31 - CVE-2024-22353 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22353

Vulnerability Analysis

The vulnerability is a network-reachable denial of service condition in IBM WebSphere Application Server Liberty. An attacker sends a specially crafted HTTP request that the server processes in a way that allocates memory without enforcing appropriate limits. Repeated or sustained requests cause the Java Virtual Machine (JVM) heap to grow until the application server becomes unresponsive or throws OutOfMemoryError exceptions.

The issue is categorized as uncontrolled resource consumption [CWE-770]. The attack requires no privileges, no user interaction, and a low attack complexity, making it accessible to any actor able to reach the server over the network. Confidentiality and integrity remain unaffected, but the impact on availability is significant for production workloads relying on continuous service.

Root Cause

The root cause lies in the absence of effective bounds on memory allocation during request handling. When the Liberty server parses or buffers attacker-controlled input from a crafted request, it does not constrain how much memory the operation can consume. IBM has not published the precise component or parser responsible, but the IBM X-Force entry 280400 confirms the resource exhaustion behavior.

Attack Vector

The attack vector is the network. An attacker delivers one or more crafted HTTP requests to a reachable Liberty endpoint. No authentication is required. The server allocates memory while processing the input, and sustained delivery drives the JVM into a low-memory state that prevents servicing legitimate traffic. Refer to the IBM Support Advisory for vendor-specific details.

Detection Methods for CVE-2024-22353

Indicators of Compromise

• Sudden growth of the WebSphere Liberty JVM heap with no corresponding increase in legitimate user traffic
• OutOfMemoryError entries or repeated garbage collection warnings in the messages.log and console.log files
• Spikes in HTTP request volume from a small set of source addresses targeting Liberty endpoints
• Application response time degradation or transport channel failures during anomalous request bursts

Detection Strategies

• Monitor JVM heap utilization, garbage collection frequency, and request processing latency for sharp deviations from baseline
• Inspect HTTP access logs for unusually large or malformed request payloads directed at Liberty endpoints
• Correlate Liberty server log errors with network telemetry to identify the source of resource-exhausting traffic
• Apply Web Application Firewall (WAF) rules that flag oversized headers, bodies, or malformed protocol fields

Monitoring Recommendations

• Enable verbose garbage collection logging in the Liberty JVM and forward logs to a centralized analytics platform
• Set alerts on heap usage thresholds and on rapid increases in java.lang.OutOfMemoryError occurrences
• Track HTTP error rates (5xx) and connection resets on Liberty listeners to identify service degradation early
• Implement rate-limiting metrics at the network or reverse-proxy tier in front of WebSphere Liberty

How to Mitigate CVE-2024-22353

Immediate Actions Required

• Apply the IBM-provided interim fix or upgrade to a fixed Liberty release as documented in the IBM Support Advisory
• Inventory all WebSphere Liberty deployments and confirm versions against the affected range 17.0.0.3 through 24.0.0.4
• Restrict network exposure of Liberty endpoints to trusted clients where business requirements permit
• Increase monitoring coverage on Liberty hosts until patches are validated in production

Patch Information

IBM has issued remediation guidance in the support bulletin at IBM Support node 7145365. Administrators should review the bulletin for the specific interim fix or fix pack applicable to their Liberty version and apply it through the standard IBM update tooling. Additional vulnerability metadata is available from the IBM X-Force entry 280400.

Workarounds

• Place a reverse proxy or WAF in front of Liberty to enforce request size limits and per-source rate limits
• Tune Liberty transport and HTTP channel configuration to constrain maximum header size, body size, and concurrent connections
• Restrict inbound access to Liberty management and application ports using network segmentation or host firewalls
• Configure JVM heap and resource limits along with automated restart policies to reduce the duration of any successful denial of service

# Example: limit HTTP request size in Liberty server.xml
# Add or adjust the httpEndpoint and httpOptions elements
# <httpEndpoint id="defaultHttpEndpoint" host="*" httpPort="9080" httpsPort="9443">
#   <tcpOptions soReuseAddr="true"/>
#   <httpOptions maxKeepAliveRequests="100" persistTimeout="30s"/>
# </httpEndpoint>