CVE-2026-15634: IBM WebSphere Application Server XSS Vulnerability

CVE-2026-15634 Overview

CVE-2026-15634 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server versions 9.0 and 8.5, along with IBM WebSphere Application Server - Liberty. The flaw stems from improper parsing of the HTTP Transfer-Encoding request header. Attackers can craft malicious HTTP requests to poison web caches, bypass web application firewall (WAF) protections, and deliver cross-site scripting (XSS) payloads to downstream users. The vulnerability is classified under [CWE-444] (Inconsistent Interpretation of HTTP Requests) and is exploitable over the network without authentication or user interaction.

Critical Impact
Remote attackers can smuggle HTTP requests through WebSphere servers to bypass security controls, poison caches serving other users, and inject XSS payloads without authenticating.

Affected Products

IBM WebSphere Application Server 9.0
IBM WebSphere Application Server 8.5
IBM WebSphere Application Server - Liberty

Discovery Timeline

2026-09-14 - CVE-2026-15634 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-15634

Vulnerability Analysis

HTTP request smuggling occurs when a front-end proxy and a back-end server disagree on the boundaries between HTTP requests within a single TCP connection. In this case, IBM WebSphere Application Server parses the Transfer-Encoding header in a way that diverges from upstream intermediaries such as reverse proxies, load balancers, or content delivery networks.

An attacker who controls the raw contents of an HTTP request can prepend or append a second request that only WebSphere interprets. This smuggled request bypasses inspection at the perimeter, reaches the application server directly, and can be attributed to another user's connection.

The practical consequences include web cache poisoning, in which malicious responses are stored and served to other clients; WAF bypass, in which filtering rules never inspect the smuggled request; and reflected or stored XSS delivered to authenticated users through the poisoned cache path.

Root Cause

The root cause is improper handling of the Transfer-Encoding header during HTTP request parsing. WebSphere accepts or normalizes Transfer-Encoding values differently than compliant intermediaries, producing conflicting interpretations of where one request ends and the next begins on a keep-alive connection.

Attack Vector

The attack requires only network access to a WebSphere endpoint reachable through a shared front-end proxy. The attacker sends a single crafted HTTP message containing an ambiguous Transfer-Encoding header, often combined with a conflicting Content-Length header. The intermediary forwards what it believes is one request, while WebSphere processes it as two, executing the smuggled second request under a victim connection context.

No verified public proof-of-concept code is available at this time. Refer to the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2026-15634

Indicators of Compromise

HTTP requests containing both Transfer-Encoding: chunked and Content-Length headers, or Transfer-Encoding values with unusual whitespace, casing, or duplicate entries.
Unexpected cached responses on shared proxies containing content that does not match the requested URL or user session.
Application logs showing request URIs or methods that were never sent by legitimate clients from a given source IP.

Detection Strategies

Deploy protocol-aware inspection at the perimeter that rejects requests carrying both Content-Length and Transfer-Encoding headers, per RFC 7230 guidance.
Correlate front-end proxy access logs with WebSphere access logs to identify request-count or byte-count discrepancies on the same TCP connection.
Hunt for HTTP responses served from cache that contain script payloads or origin content mismatched to the requesting client.

Monitoring Recommendations

Enable verbose HTTP request logging on WebSphere and forward logs to a centralized analytics platform for pattern analysis.
Alert on repeated malformed Transfer-Encoding header values from a single source, which often indicates smuggling reconnaissance.
Monitor cache hit ratios and cached response sizes for anomalies consistent with poisoning attempts.

How to Mitigate CVE-2026-15634

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Page to affected WebSphere Application Server 9.0, 8.5, and Liberty deployments.
Inventory all internet-exposed WebSphere instances and prioritize patching those behind shared caches, CDNs, or WAFs.
Review web cache contents and invalidate any entries that may have been poisoned during the exposure window.

Patch Information

IBM has published remediation guidance and interim fixes through its support portal. Administrators should consult the IBM Support Page for the exact fix pack, iFix identifier, and installation instructions applicable to their WebSphere version.

Workarounds

Configure the front-end proxy or load balancer to normalize or strip ambiguous Transfer-Encoding headers before forwarding requests to WebSphere.
Disable HTTP keep-alive on the front-end to back-end hop, forcing one request per TCP connection until patching is complete.
Enforce strict HTTP/1.1 compliance at the WAF layer and reject requests containing conflicting message-framing headers.

bash

# Example: reject requests with both Transfer-Encoding and Content-Length at an Nginx front-end
if ($http_transfer_encoding ~* "chunked") {
    if ($http_content_length) {
        return 400;
    }
}