CVE-2025-36047: IBM WebSphere Application Server DoS Flaw

CVE-2025-36047 Overview

CVE-2025-36047 affects IBM WebSphere Application Server Liberty versions 18.0.0.2 through 25.0.0.8. The flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending a specially-crafted request that forces the server to consume excessive memory resources. The weakness is classified under CWE-770: Allocation of Resources Without Limits or Throttling. Successful exploitation degrades availability of hosted Java EE and Jakarta EE applications running on Liberty profiles across supported operating systems.

Critical Impact
A network-based attacker without credentials or user interaction can exhaust server memory and disrupt availability of every application hosted on a vulnerable Liberty instance.

Affected Products

IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8
Deployments on IBM AIX, IBM i, and IBM z/OS
Deployments on Linux, Microsoft Windows, and Apple macOS

Discovery Timeline

2025-08-14 - CVE-2025-36047 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-36047

Vulnerability Analysis

The vulnerability is a memory-exhaustion denial of service in the request-handling path of WebSphere Application Server Liberty. An attacker crafts a request that the server processes without enforcing limits on the memory it allocates during parsing or buffering. Repeated or sufficiently large requests inflate the Java Virtual Machine (JVM) heap, eventually triggering OutOfMemoryError conditions, garbage-collection thrashing, or full process termination.

Because Liberty serves as the runtime for many enterprise web applications and APIs, exhaustion of the underlying JVM affects every deployed module on the same server instance. The condition impacts availability only — confidentiality and integrity are not affected.

Root Cause

The defect maps to [CWE-770], where input handling allocates resources without applying upper bounds or throttling. The server fails to bound memory allocation tied to attacker-controlled request attributes, allowing a single connection to consume disproportionate heap space.

Attack Vector

Exploitation requires only network access to a Liberty HTTP/HTTPS endpoint. No authentication or user interaction is required. An attacker sends one or more crafted requests to a reachable Liberty listener. The malicious payload coerces the server to allocate large amounts of memory until the JVM is exhausted. Public proof-of-concept code has not been released. Refer to the IBM Support advisory and CERT/CC VU#767506 for vendor-supplied technical context.

Detection Methods for CVE-2025-36047

Indicators of Compromise

Sudden spikes in JVM heap utilization or frequent full garbage-collection events on Liberty servers.
OutOfMemoryError entries in messages.log or console.log correlated with inbound HTTP traffic.
Liberty process restarts or unresponsive HTTP listeners coinciding with anomalous request patterns.

Detection Strategies

Inspect HTTP access logs for unusually large request bodies, headers, or repeated requests from a single source IP.
Correlate JVM memory metrics with web traffic telemetry to identify request patterns that drive heap growth.
Apply web application firewall (WAF) rules to flag oversized or malformed requests targeting Liberty endpoints.

Monitoring Recommendations

Enable JVM heap and garbage-collection telemetry through Java Management Extensions (JMX) or IBM Health Center.
Forward Liberty messages.log, ffdc/, and HTTP access logs to a centralized SIEM for anomaly analysis.
Alert on Liberty process restarts and abnormal thread or memory consumption thresholds.

How to Mitigate CVE-2025-36047

Immediate Actions Required

Inventory all WebSphere Application Server Liberty installations and identify versions in the 18.0.0.2 to 25.0.0.8 range.
Apply the IBM-supplied interim fix or upgrade as documented in the vendor advisory.
Restrict network exposure of Liberty management and application ports to trusted networks where feasible.

Patch Information

IBM has published remediation guidance and fix availability on the IBM Support page for CVE-2025-36047. Administrators should apply the recommended interim fix or upgrade to a fixed Liberty release. Additional vendor-neutral context is available in the CERT/CC Vulnerability Note VU#767506.

Workarounds

Deploy a reverse proxy or WAF in front of Liberty to enforce request size, header, and rate limits.
Configure Liberty httpEndpoint and HTTP options to constrain maximum request, header, and field sizes.
Apply per-source connection rate limiting at the network or load balancer tier until patches are deployed.

bash

# Example Liberty server.xml hardening to constrain request resource usage
# Adjust values to match application requirements
<server>
  <httpEndpoint id="defaultHttpEndpoint"
                host="*"
                httpPort="9080"
                httpsPort="9443">
    <httpOptions maxFieldSize="8192"
                 maxHeaderSize="16384"
                 readTimeout="30s"
                 writeTimeout="30s"
                 keepAliveTimeout="30s"/>
  </httpEndpoint>
</server>