Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T20:16:38.153Z",
  "pubdate": "2026-09-14T20:16:38.153Z",
  "executiveSummary": "IBM WebSphere Application Server versions 9.0 and 8.5, as well as IBM WebSphere Application Server - Liberty, are susceptible to an HTTP Request Smuggling vulnerability.\nThe flaw originates from improper parsing of the HTTP Transfer-Encoding header, which allows an attacker to manipulate how the server interprets request boundaries.\nSuccessful exploitation enables an attacker to poison web caches, circumvent Web Application Firewall (WAF) security controls, and execute Cross-Site Scripting (XSS) attacks by injecting malicious content into subsequent user requests.\nThe vulnerability poses a significant risk to data integrity and session security, potentially allowing unauthorized actors to perform actions on behalf of legitimate users or compromise sensitive information transmitted over the HTTP protocol.\nThis vulnerability is classified as a request smuggling issue, which typically requires no special authentication, allowing remote, unauthenticated attackers to exploit the server directly over the network.",
  "technicalDetails": "The root cause of this vulnerability lies in the non-compliant or ambiguous parsing of the HTTP Transfer-Encoding header within the IBM WebSphere Application Server request processing pipeline.\nHTTP Request Smuggling occurs when there is a discrepancy between how a front-end server (such as a proxy or load balancer) and a back-end server (the WebSphere instance) interpret the length of an HTTP request, specifically when both Content-Length and Transfer-Encoding headers are present or malformed.\nBy crafting a request that includes both Transfer-Encoding and Content-Length headers, or by obfuscating the Transfer-Encoding header, an attacker can cause the front-end and back-end to disagree on where a request ends.\nThis ambiguity allows an attacker to 'smuggle' a secondary, hidden request within the body of the first request. The back-end server processes the first request and interprets the smuggled data as the start of a new, separate HTTP request sent by a different user.\nAttack Flow: 1. The attacker sends a malformed request to the WebSphere server containing a crafted Transfer-Encoding header. 2. The front-end proxy processes the request based on its parsing logic, while the WebSphere back-end misinterprets the request boundaries due to the improper parsing implementation. 3. The back-end treats the tail end of the attacker's payload as a new request. 4. Subsequent legitimate requests from other users are appended to the attacker's smuggled request, effectively hijacking their session context or injecting malicious script payloads.\nThe impact of this behavior is multi-faceted. Cache poisoning occurs when the smuggled request results in a response that the server incorrectly associates with a legitimate URL, causing that response to be served to subsequent, unsuspecting users. WAF bypass is achieved because the WAF inspects the initial request, failing to see the smuggled payload that is only parsed by the back-end. XSS exploitation occurs when the smuggled request forces the server to return injected JavaScript, which executes in the context of the victim's browser session.\nThe vulnerability affects IBM WebSphere Application Server 9.0 and 8.5, as well as the Liberty profile. Exploitation does not require prior authentication and can be executed over standard network connections where the target server is exposed to HTTP traffic."
}