CVE-2026-4410: IBM WebSphere Application Server DoS Flaw

CVE-2026-4410 Overview

CVE-2026-4410 is a denial of service vulnerability affecting IBM WebSphere Application Server Liberty versions 19.0.0.7 through 26.0.0.5, IBM WebSphere Application Server 9.0, and IBM WebSphere Application Server 8.5. The flaw allows a remote attacker on an adjacent network to send a specially-crafted request that forces the server to consume excessive memory resources. The condition is categorized under [CWE-400] (Uncontrolled Resource Consumption). Successful exploitation degrades application availability without affecting data confidentiality or integrity.

Critical Impact
A specially-crafted request can exhaust memory on the target WebSphere instance, leading to service degradation or outage for hosted Java EE workloads.

Affected Products

IBM WebSphere Application Server Liberty 19.0.0.7 through 26.0.0.5
IBM WebSphere Application Server 9.0
IBM WebSphere Application Server 8.5

Discovery Timeline

2026-05-27 - CVE-2026-4410 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-4410

Vulnerability Analysis

The vulnerability stems from improper resource consumption controls in the request processing pipeline of IBM WebSphere Application Server and WebSphere Application Server Liberty. When the server receives a specially-crafted request, internal handlers allocate memory without enforcing adequate bounds. Repeated or targeted requests cause sustained memory growth, eventually exhausting the Java Virtual Machine (JVM) heap or process address space.

The impact is limited to availability. The CVSS vector indicates no impact to confidentiality or integrity, but availability impact is high. Exploitation requires adjacent network access and low privileges, which constrains the attacker population to authenticated users on the same logical network segment.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in request parsing or handling logic. The affected components fail to cap allocations tied to attacker-controlled input fields. This allows a single crafted request to consume disproportionate memory relative to its size.

Attack Vector

An authenticated attacker with adjacent network access sends crafted requests to a vulnerable WebSphere endpoint. The crafted payload triggers oversized memory allocations on the server. Sustained exploitation forces garbage collection pressure, OutOfMemoryError conditions, or full process termination. No verified public proof-of-concept code is available at this time. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-4410

Indicators of Compromise

Sudden and sustained increase in JVM heap utilization on WebSphere instances without a corresponding rise in legitimate traffic volume.
Frequent java.lang.OutOfMemoryError entries in messages.log or SystemOut.log files.
Application server restarts or thread pool exhaustion correlated with requests from a single adjacent host.

Detection Strategies

Baseline normal memory and request-size profiles for each WebSphere endpoint, then alert on statistical deviations.
Inspect HTTP access logs for repeated requests with anomalous header sizes, payload sizes, or parameter counts directed at the same endpoint.
Correlate JVM garbage collection logs with inbound request patterns to identify attacker-induced allocation spikes.

Monitoring Recommendations

Enable verbose garbage collection logging and forward JVM metrics to a centralized monitoring system.
Monitor WebSphere PMI (Performance Monitoring Infrastructure) counters for thread pool, session, and heap saturation.
Alert on repeated HTTP 5xx responses from WebSphere combined with elevated memory pressure.

How to Mitigate CVE-2026-4410

Immediate Actions Required

Apply the IBM-supplied interim fix or upgrade to a fixed version as documented on the IBM Support Page.
Restrict adjacent network access to WebSphere management and application ports using network segmentation and host firewalls.
Enforce request size limits and connection rate limits at upstream load balancers or reverse proxies.

Patch Information

IBM has published remediation guidance for affected WebSphere Application Server and Liberty versions. Administrators should consult the IBM Support Page for fix pack identifiers and interim fix availability covering Liberty 19.0.0.7 through 26.0.0.5, WebSphere 9.0, and WebSphere 8.5.

Workarounds

Configure HTTP request size and header limits in the WebSphere httpEndpoint or httpOptions configuration to reject oversized payloads.
Place WebSphere behind a Web Application Firewall (WAF) tuned to drop malformed or oversized requests.
Limit principal accounts permitted to reach application endpoints from adjacent networks until patching is complete.

bash

# Configuration example: restrict request size in WebSphere Liberty server.xml
<httpEndpoint id="defaultHttpEndpoint"
              host="*"
              httpPort="9080"
              httpsPort="9443">
    <httpOptions maxFieldSize="8192"
                 maxHeaderSize="16384"
                 readTimeout="30s"
                 writeTimeout="30s"/>
</httpEndpoint>