CVE-2025-36099 Overview
IBM WebSphere Application Server versions 8.5 and 9.0 contain a denial-of-service vulnerability tracked as CVE-2025-36099. A privileged user can send a specially crafted request that forces the server to consume excessive memory resources. The flaw is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling) and affects availability without impacting confidentiality or integrity.
Critical Impact
An authenticated attacker with elevated privileges can exhaust server memory and disrupt application availability across WebSphere-hosted workloads.
Affected Products
- IBM WebSphere Application Server 8.5
- IBM WebSphere Application Server 9.0
- Deployments using CPE cpe:2.3:a:ibm:websphere_application_server:8.5.0.0 and 9.0.0.0
Discovery Timeline
- 2025-09-29 - CVE-2025-36099 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36099
Vulnerability Analysis
CVE-2025-36099 is a denial-of-service condition rooted in unbounded resource allocation. When a privileged user submits a specially crafted request, the WebSphere Application Server processes the input without enforcing appropriate memory allocation limits. The server allocates progressively larger memory buffers until Java Virtual Machine (JVM) heap exhaustion degrades or halts application processing.
The issue is reachable over the network and requires no user interaction. Because exploitation requires high privileges, the attack surface is limited to authenticated administrative contexts or compromised service accounts with elevated access to the server.
Root Cause
The root cause is missing resource governance during request handling, aligned with [CWE-770]. The application accepts and processes input that triggers open-ended memory allocation. Without upper bounds or throttling controls, repeated or single crafted requests can drive the JVM into out-of-memory conditions.
Attack Vector
Exploitation is network-based and low complexity. An attacker authenticated with a privileged account submits a crafted request to a reachable WebSphere endpoint. The malformed input causes the server to allocate memory beyond safe operational thresholds, producing a denial-of-service outcome.
No public proof-of-concept exploit is available for CVE-2025-36099. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the IBM Support Article for vendor-supplied technical details.
Detection Methods for CVE-2025-36099
Indicators of Compromise
- Sudden JVM heap growth followed by OutOfMemoryError entries in WebSphere SystemOut.log or SystemErr.log
- Unresponsive WebSphere application servers requiring restart after processing requests from privileged accounts
- Elevated garbage collection activity correlated with inbound administrative traffic
Detection Strategies
- Monitor JVM memory utilization and full garbage collection frequency for anomalous spikes on WebSphere nodes
- Correlate administrative session activity with server resource exhaustion events
- Review access logs for repeated or malformed requests originating from privileged accounts
Monitoring Recommendations
- Enable and forward WebSphere Performance Monitoring Infrastructure (PMI) metrics to a centralized logging platform
- Alert on JVM heap thresholds exceeding operational baselines
- Track privileged account authentication events and administrative API usage for anomalies
How to Mitigate CVE-2025-36099
Immediate Actions Required
- Apply the interim fix or cumulative patch published in the IBM Support Article for WebSphere Application Server 8.5 and 9.0
- Audit and reduce the number of accounts holding privileged WebSphere roles
- Rotate credentials for administrative accounts and enforce multi-factor authentication on administrative consoles
Patch Information
IBM has published remediation guidance and fix packs for WebSphere Application Server 8.5 and 9.0. Review the vendor advisory at the IBM Support Article to identify the correct interim fix for your installed version and fix pack level. Apply the update through the IBM Installation Manager or the WebSphere update tooling used in your environment.
Workarounds
- Restrict network access to WebSphere administrative endpoints using firewall rules or reverse proxies
- Enforce strict role-based access control to minimize the number of privileged users on production servers
- Configure JVM heap limits and request size constraints to reduce the blast radius of memory-consumption attacks
# Example: restrict access to the WebSphere administrative console port (default 9043)
# using iptables so only trusted management hosts can reach it
iptables -A INPUT -p tcp --dport 9043 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9043 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
