CVE-2026-105442: IBM WebSphere Application Server DoS Vulnerability

CVE-2026-105442 Overview

CVE-2026-105442 is an insecure deserialization vulnerability in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The flaw resides in the messaging service and allows a remote, unauthenticated attacker to trigger a denial of service condition. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Remote unauthenticated attackers can disrupt availability of the WebSphere messaging service by submitting crafted serialized objects, causing a denial of service on affected application servers.

Affected Products

IBM WebSphere Application Server 8.5
IBM WebSphere Application Server 9.0
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10

Discovery Timeline

2026-10-13 - CVE-2026-105442 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-105442

Vulnerability Analysis

The vulnerability affects the messaging service component of IBM WebSphere Application Server. The service accepts serialized Java objects without sufficient validation of the object graph prior to deserialization. An attacker reachable over the network can submit a crafted serialized payload that forces the server to process malicious object constructs during deserialization.

Successful exploitation leads to resource exhaustion or an unhandled runtime condition in the messaging engine. The result is a denial of service against the application server, which disrupts hosted applications and queued message processing. The attack requires no authentication and no user interaction.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected, along with traditional WebSphere 8.5 and 9.0. The flaw is scoped to availability impact only; confidentiality and integrity are not affected according to the published CVSS vector.

Root Cause

The root cause is improper handling of untrusted serialized data in the messaging service [CWE-502]. The affected code path performs deserialization before validating the type, structure, or size of incoming objects. Java deserialization in this context allows attacker-controlled gadget chains or oversized object graphs to consume CPU and memory until the service becomes unresponsive.

Attack Vector

The attack vector is network-based with low complexity and no required privileges. An attacker sends a crafted message containing a malicious serialized object to the WebSphere messaging endpoint. The server deserializes the payload and triggers the denial of service condition. See the IBM Support Page for vendor-specific exploitation details.

Detection Methods for CVE-2026-105442

Indicators of Compromise

Unexpected spikes in CPU or heap utilization on WebSphere JVM processes correlated with inbound messaging traffic.
OutOfMemoryError, StackOverflowError, or unexplained thread hangs in SystemOut.log and FFDC logs tied to the messaging engine.
Repeated connection resets or abnormal termination of messaging listener threads.

Detection Strategies

Inspect WebSphere FFDC and SystemOut logs for deserialization stack traces originating from com.ibm.ws.sib.* messaging classes.
Monitor messaging endpoints for unusually large or malformed serialized Java payloads (magic bytes AC ED 00 05).
Correlate network traffic to WebSphere messaging ports with sudden drops in application responsiveness or health check failures.

Monitoring Recommendations

Enable JVM-level monitoring for heap usage, garbage collection pauses, and thread count on all WebSphere instances.
Forward WebSphere logs and messaging engine metrics to a central SIEM or data lake for behavioral baselining.
Alert on anomalous inbound traffic patterns targeting SIB (Service Integration Bus) listener ports.

How to Mitigate CVE-2026-105442

Immediate Actions Required

Apply the IBM-provided interim fix or upgrade to the fixed version documented on the IBM Support Page.
Restrict network access to WebSphere messaging endpoints to trusted internal hosts and application tiers only.
Review and enable Java deserialization filtering (jdk.serialFilter) to constrain acceptable classes.

Patch Information

IBM has published remediation guidance and fix pack information on the IBM Support Page for CVE-2026-105442. Administrators should follow the vendor matrix to select the appropriate interim fix for their WebSphere Application Server 8.5, 9.0, or Liberty version in the range 17.0.0.3 through 26.0.0.10.

Workarounds

Place WebSphere messaging endpoints behind a network segmentation boundary or firewall allow-list.
Configure a JVM-wide serialization filter to reject unexpected classes using -Djdk.serialFilter.
Disable or isolate unused messaging engines and SIB destinations to reduce attack surface.

bash

# Example JVM serialization filter configuration (apply to WebSphere generic JVM arguments)
-Djdk.serialFilter="maxdepth=20;maxrefs=1000;maxbytes=100000;maxarray=10000;!*"