Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-14T19:17:15.693Z",
  "pubdate": "2026-09-14T19:17:15.693Z",
  "executiveSummary": "This vulnerability involves a race condition flaw within the IBM i operating system, specifically affecting the WebSocket handshake process. The vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6. An authenticated remote attacker can exploit this synchronization issue to bypass intended security controls and perform unauthorized access to sensitive information. Because the vulnerability resides within the session establishment phase of the WebSocket protocol, it poses a significant risk to data confidentiality. The exploitation requires the attacker to possess authenticated access to the system, but does not necessitate additional high-level privileges. Successful exploitation allows for the potential exfiltration of sensitive data that should be protected during the handshake sequence. Given the nature of IBM i systems, which often manage critical business and financial data, this flaw represents a notable risk to organizational data integrity and privacy.",
  "technicalDetails": "The vulnerability is rooted in a race condition existing within the WebSocket handshake implementation of IBM i versions 7.3 through 7.6. The WebSocket protocol upgrade process requires a precise, atomic sequence of state transitions to transition an HTTP connection to a full-duplex WebSocket connection. In the affected IBM i components, the server-side logic managing this upgrade process fails to correctly synchronize threads or state checks during the transition period.\nThe exploitation flow initiates when a remote authenticated attacker sends specifically timed WebSocket handshake requests. By flooding the server or initiating multiple concurrent connection attempts that overlap during the critical handshake window, the attacker forces the underlying handler to enter a race condition. In this state, the application logic may fail to correctly associate the session context or security tokens with the established connection.\nBecause the state is inconsistently managed during this window, the system may inadvertently expose sensitive information residing in the memory buffer or the session data structure to the attacker's established connection. The vulnerable component is the IBM i HTTP server or the integrated application server tasked with WebSocket management. The race condition allows an attacker to manipulate the handshake sequence so that the server processes requests against a partially initialized or improperly secured session object.\nTechnically, the issue suggests a lack of thread-safety or improper mutex implementation during the socket upgrade handshake. When multiple requests compete for the same handshake resource, the lack of proper synchronization leads to an interleaving of data where security headers or session identity can be 'leaked' or mismatched. An attacker does not require administrative privileges, but must be able to establish an authenticated session to reach the WebSocket entry point. Once the race condition is triggered, the post-exploitation impact includes the successful interception or unauthorized retrieval of sensitive information intended for other users or administrative sessions. This represents a breakdown in the isolation of concurrent WebSocket streams, effectively allowing for cross-session information disclosure."
}