Description

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T20:16:38.540Z",
  "pubdate": "2026-09-14T20:16:38.540Z",
  "executiveSummary": "IBM WebSphere Application Server versions 9.0, 8.5, and IBM WebSphere Application Server - Liberty are susceptible to an HTTP Request Smuggling vulnerability.\nThe vulnerability arises from the improper parsing of the HTTP 'Transfer-Encoding' request header, which fails to correctly normalize or validate the presence of malformed or conflicting headers.\nSuccessful exploitation allows an unauthenticated remote attacker to manipulate the interpretation of request boundaries between front-end proxies and back-end server components.\nThis architectural misalignment enables a range of high-severity attacks, including web cache poisoning, bypassing Web Application Firewall (WAF) security controls, and the injection of unauthorized content for Cross-Site Scripting (XSS) scenarios.\nBy leveraging discrepancies in how the application server processes the 'Transfer-Encoding' header, an attacker can influence the request stream processed by the back-end, effectively desynchronizing the communication channel.\nThis flaw presents significant risk to confidentiality and integrity, as attackers can hijack legitimate user sessions or poison downstream caches to serve malicious content to unsuspecting victims.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the 'Transfer-Encoding' HTTP header within the request parsing logic of IBM WebSphere Application Server and Liberty. HTTP Request Smuggling occurs when there is a discrepancy between the front-end load balancer or reverse proxy and the back-end application server regarding how the boundaries of an HTTP request are delineated.\nSpecifically, the parsing mechanism fails to sanitize or reject requests containing conflicting or non-standard 'Transfer-Encoding' values. When a request is constructed with malformed headers, the front-end may interpret the request length differently than the back-end. If the front-end ignores a specific encoding variant while the back-end respects it, a portion of the attacker's payload remains in the server's buffer.\nThe attack flow follows a desynchronization pattern: 1) The attacker transmits a specially crafted HTTP request containing ambiguous 'Transfer-Encoding' headers. 2) The front-end proxy parses the request according to its own logic, potentially treating the request as a single unit or failing to recognize the smuggled component. 3) The back-end, however, processes the 'Transfer-Encoding' header in a way that causes it to consume only a portion of the stream, leaving the 'smuggled' data sitting in the request buffer as the prefix of the next incoming request.\nConsequently, the smuggled data is prepended to the subsequent request handled by the server. If this subsequent request originates from a legitimate user, the attacker's injected code or headers are executed as part of that victim's session. This allows for: 1) Cache Poisoning, where the server maps an incorrect response to a different URL; 2) WAF Bypass, where malicious payloads are hidden inside the body of a request that the proxy deems benign; and 3) XSS, where the smuggled request forces the server to return an injected script to the victim.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated privileges. It affects any network-exposed instance of the specified WebSphere versions, as the defect exists within the foundational HTTP processing engine of the application server. The payload behavior relies on exploiting the discrepancy in state management between the proxy and the server to achieve unauthorized execution context."
}