Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-13T20:17:13.640Z",
  "pubdate": "2026-08-13T20:17:13.640Z",
  "executiveSummary": "A denial of service vulnerability driven by insecure deserialization exists in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8. The security flaw manifests when the restConnector-2.0 feature is active, potentially allowing an authenticated low-privileged, administrative user to exhaust critical system resources.\nThe primary risk implications involve service degradation and potential availability loss of the application server instance. Successful exploitation requires the attacker to possess specific administrative privileges and target environments where the vulnerable restConnector-2.0 component is enabled.\nThe vulnerability represents a significant risk to system availability, necessitating prompt remediation actions by system administrators to prevent resource exhaustion attacks originating from within the administrative tier.",
  "technicalDetails": "The vulnerability stems from insecure deserialization mechanisms within IBM WebSphere Application Server - Liberty, specifically affecting versions 17.0.0.3 through 26.0.0.8.\nThe flaw resides within the restConnector-2.0 feature, which handles remote administrative connectivity and management operations.\nExploitation requires the attacker to authenticate as a low-privileged, administrative user who can interact with the restConnector-2.0 feature endpoint over the network.\nThe attack flow proceeds as follows: the malicious actor crafts a specialized serialized payload designed to trigger excessive resource allocation upon deserialization by the server component. The attacker then transmits this payload to the restConnector-2.0 endpoint.\nUpon receipt, the vulnerable component processes and deserializes the untrusted data without proper validation or sanitization. This improper handling forces the underlying Java Virtual Machine to consume disproportionate amounts of CPU and memory resources.\nThe resulting payload behavior leads directly to a denial of service condition, disrupting normal server operations and impacting availability for legitimate administrative and application workloads.\nNetwork exposure is restricted to interfaces hosting the restConnector-2.0 service, and privilege requirements mandate at least a low-privileged administrative account to initiate the attack sequence."
}