CVE-2026-15634 in WebSphere Application Server
Summary
by MITRE • 09/14/2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
IBM WebSphere Application Server versions 9.0 and 8.5, along with IBM WebSphere Application Server Liberty, contain a critical security flaw related to HTTP request smuggling. This vulnerability stems from an improper parsing mechanism for the HTTP transfer-encoding header within the application server's request processing pipeline. The core technical issue lies in the discrepancy between how the front-end infrastructure or load balancer interprets certain malformed headers and how the backend IBM WebSphere Application Server processes them. When a client sends a specially crafted HTTP request containing ambiguous or conflicting Transfer-Encoding directives, such as combining chunked encoding with other content-length indicators or using invalid syntax that triggers different parsing logic paths in the proxy versus the application server, the two entities may disagree on where one request ends and another begins. This misalignment creates an opportunity for HTTP request smuggling, a class of attacks first popularized by researchers who demonstrated how inconsistent interpretation of HTTP protocol specifications can be leveraged to manipulate traffic flow between intermediaries and origin servers.
The operational impact of this vulnerability is severe because it allows an attacker to poison the web cache or bypass security controls positioned in front of the application server. By successfully smuggling a request, an adversary can inject malicious content that appears to originate from a trusted internal source or legitimate user session. This capability enables several distinct attack vectors. First, cache poisoning occurs when the smuggled response is stored by intermediate caching servers and subsequently served to other users, potentially delivering malware or defacing web pages on a large scale without direct access to the backend server for each victim. Second, the vulnerability facilitates bypassing Web Application Firewall protections. Since the WAF may inspect only the first part of the request it parses correctly while ignoring the smuggled portion that is processed by the application server, malicious payloads such as SQL injection or cross-site scripting scripts can slip through inspection filters undetected.
Furthermore, this flaw directly enables Cross-Site Scripting attacks against other users who interact with the poisoned cache or receive manipulated responses from the backend. An attacker could craft a request that includes JavaScript code within the smuggled segment of the HTTP stream. When the application server processes this input and returns it to clients via a cached response, any user loading that page will execute the malicious script in their browser context under the trust domain of IBM WebSphere Application Server. This leads to session hijacking, credential theft, administrative takeover, or defacement depending on the privileges associated with the targeted account. The attack requires no authentication if it targets public-facing caches but can be even more damaging when combined with authenticated sessions to perform privileged actions that would otherwise be restricted by access control mechanisms.
From a classification perspective, this vulnerability aligns with CWE-437, which describes incomplete interpretation of an input in the presence of ambiguity, specifically within HTTP request parsing logic. It also maps closely to MITRE ATT&CK technique T1071, Application Layer Protocol: Web Protocols, where adversaries use standard web protocols like HTTP and HTTPS for command and control or data exfiltration by exploiting protocol ambiguities. The specific behavior of manipulating the boundary between requests falls under the broader category of request smuggling attacks documented in various industry advisories as a high-severity risk due to its potential for widespread impact across multiple users through cache poisoning mechanisms.
Mitigation strategies must focus on ensuring consistent parsing logic across all layers of the infrastructure and applying vendor-provided fixes immediately. IBM has released patches that correct the handling of the Transfer-Encoding header to prevent ambiguous interpretations. Administrators should apply these updates as a priority, particularly for systems exposed to untrusted networks or public internet traffic. In addition to patching, organizations can implement strict input validation rules at the reverse proxy or load balancer level to reject requests with malformed or conflicting HTTP headers before they reach the application server. Configuring web servers to normalize and strictly validate Transfer-Encoding values according to RFC 7230 standards helps eliminate ambiguity. Network segmentation should also be reviewed to ensure that internal services are not directly accessible from untrusted zones, reducing the attack surface for exploitation attempts involving cache poisoning or firewall bypass techniques.