CVE-2026-15325: IBM WebSphere DoS Vulnerability

CVE-2026-15325 Overview

CVE-2026-15325 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server. The flaw stems from improper handling of TRACE requests in the affected server versions. Attackers can exploit this weakness over the network without authentication to desynchronize front-end and back-end HTTP parsing. Successful exploitation compromises confidentiality and integrity of application traffic on the shared connection. The issue is tracked under CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Unauthenticated network attackers can smuggle HTTP requests through WebSphere, enabling cache poisoning, session hijacking, and bypass of front-end security controls.

Affected Products

IBM WebSphere Application Server 9.0
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7

Discovery Timeline

2026-07-28 - CVE-2026-15325 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15325

Vulnerability Analysis

CVE-2026-15325 is an HTTP request smuggling flaw rooted in how IBM WebSphere Application Server processes TRACE requests. HTTP request smuggling occurs when intermediaries and origin servers disagree on where one request ends and the next begins. An attacker crafts a single TCP payload that the front-end parser treats as one request while WebSphere interprets it as two. The smuggled second request executes in the context of another user's connection.

Because exploitation is unauthenticated and network-based, any exposed WebSphere instance is reachable. The scope change indicated by the CVSS vector reflects that a successful attack impacts components beyond the vulnerable server itself. Downstream applications, reverse proxies, and caching layers all inherit the desynchronized state.

Root Cause

The vulnerability arises from inconsistent parsing of the HTTP TRACE method. Standard HTTP request smuggling patterns involve conflicting Content-Length and Transfer-Encoding headers, or ambiguous framing that intermediaries resolve differently than the origin. In this case, WebSphere's handling of TRACE payloads permits an attacker-controlled request body to be reinterpreted as a subsequent request.

Attack Vector

An attacker sends a specially crafted TRACE request through a front-end proxy or load balancer to a WebSphere back end. The proxy forwards what it considers a single request. WebSphere parses the payload as two requests, treating the smuggled portion as if it originated from the next legitimate client on the reused connection. Refer to the IBM Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-15325

Indicators of Compromise

Unexpected TRACE method requests in access logs, particularly with unusual Content-Length or Transfer-Encoding headers
Requests where response bodies contain fragments of other users' requests or session cookies
Discrepancies between front-end proxy logs and WebSphere access logs for the same connection
Cache entries containing responses that do not match the requested URL

Detection Strategies

Enable verbose HTTP logging on both the reverse proxy and WebSphere to correlate request boundaries across tiers
Deploy web application firewall rules that flag or block TRACE requests carrying request-line-like content in the body
Alert on HTTP responses where Content-Length mismatches the delivered payload size on WebSphere connections
Baseline normal TRACE request volume; any TRACE traffic to production endpoints warrants investigation

Monitoring Recommendations

Forward WebSphere HTTP and SystemOut logs to a centralized SIEM for cross-tier correlation
Monitor for authentication anomalies such as session use from unexpected IP addresses following TRACE activity
Track cache poisoning symptoms including users receiving pages intended for other sessions

How to Mitigate CVE-2026-15325

Immediate Actions Required

Inventory all WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.7 deployments
Apply IBM's security updates as referenced in the IBM Security Advisory
Disable the TRACE method on WebSphere and upstream proxies where the method is not required for operations
Restrict inbound access to WebSphere management and application ports to trusted networks pending patching

Patch Information

IBM has published remediation guidance in the IBM Security Advisory covering WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7. Administrators should consult the advisory for the specific fix pack or interim fix that applies to their deployed version.

Workarounds

Configure the front-end HTTP server or load balancer to reject TRACE requests before they reach WebSphere
Set TraceEnable Off in Apache-based front ends, or the equivalent directive in other reverse proxies
Disable HTTP connection reuse (keep-alive) between the proxy and WebSphere to limit smuggling impact
Enforce strict HTTP parsing on intermediaries to reject requests with ambiguous framing headers

bash

# Example: Disable TRACE at an Apache HTTP Server front end
TraceEnable Off

# Example: Block TRACE at an NGINX reverse proxy
if ($request_method = TRACE) {
    return 405;
}