Stack-based buffer overflow in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2025-36097

Vulnerability identifier: #VU113074

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-36097

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a stack-based overflow. A remote unauthenticated attacker can send a specially crafted request that cause the server to consume excessive memory resources.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
IBM Tivoli Network Manager (ITNM)
Enterprise Application Runtimes
Operations Analytics - Log Analysis
PowerVM NovaLink
Cloud Pak for Applications
WebSphere Hybrid Edition
IBM Tivoli Netcool Configuration Manager
Engineering Test Management
Tivoli Composite Application Manager for Application Diagnostics
Control Desk
Business Monitor
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Maximo Application Suite - Predict Component
Verify Identity Access Digital Credentials
DevOps Code ClearCase
Business Automation Insights
Application Modernization Accelerator
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Storage Protect Operations Center
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Space Management
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect Client
Voice Gateway
Jazz for Service Management
Log Analysis
Netcool Operations Insight
IBM Cloud Transformation Advisor
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM Rational ClearCase
IBM Rational ClearQuest
InfoSphere Master Data Management
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Security Verify Access
IBM CICS TX Advanced
IBM CICS TX Standard

Install updates from vendor's website.

IBM WebSphere Application Server - update to 9.0.5.25
IBM WebSphere Application Server Liberty - update to 25.0.0.8
Voice Gateway - addressed in versions 1.0.8.17, 1.0.8.21
Operations Analytics - Log Analysis - update to 1.3.8.2
Netcool Operations Insight - update to 1.6.15
PowerVM NovaLink - addressed in versions 2.1.1-251007, 2.2.1.1-251007, 2.3.1-251007
IBM Cloud Transformation Advisor - update to 4.4.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
IBM Spectrum Control - update to 5.4.13.2
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.29, 8.7.23, 9.0.16, 9.1.2
IBM Maximo Application Suite - addressed in versions 8.10.29, 8.11.26, 9.0.15, 9.1.3
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
Maximo Application Suite - Predict Component - update to 9.1.1
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.5, 25.0.0.0.2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF007, 24.0.1-IF005, 25.0.0-IF002
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Application Modernization Accelerator - update to 4.4.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
Storage Protect Operations Center - update to 8.1.27.100
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.1
Storage Protect for Space Management - update to 8.2.1
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.1
Storage Protect Client - update to 8.2.1
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix42, 11.1.0.0 ifix34
IBM CICS TX Standard - update to 11.1.0.0 ifix35

• https://www.ibm.com/support/pages/node/7239856

• Stack-based buffer overflow in IBM WebSphere Application Server and WebSphere Application Server Liberty
• Stack-based buffer overflow in IBM Maximo Asset Management
• Stack-based buffer overflow in IBM WebSphere Remote Server
• Stack-based buffer overflow in IBM Jazz for Service Management
• Stack-based buffer overflow in IBM Tivoli Composite Application Manager for Application Diagnostics
• Stack-based buffer overflow in IBM Tivoli System Automation Application Manager
• Stack-based buffer overflow in IBM Business Monitor
• Stack-based buffer overflow in IBM Cloud Pak for Applications
• Stack-based buffer overflow in IBM Enterprise Application Runtimes
• Stack-based buffer overflow in IBM WebSphere Hybrid Edition
• Stack-based buffer overflow in IBM Control Desk
• Stack-based buffer overflow in IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM)
• Stack-based buffer overflow in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Stack-based buffer overflow in IBM Watson Discovery
• Stack-based buffer overflow in IBM Engineering Test Management
• Stack-based buffer overflow in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Stack-based buffer overflow in IBM Log Analysis
• Multiple vulnerabilities in IBM OpenPages
• Stack-based buffer overflow in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM Maximo Application Suite
• Stack-based buffer overflow in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Business Automation Workflow
• IBM Storage Protect Operations Center update for IBM WebSphere Application Server
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Verify Identity Access and IBM Security Verify Access
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Stack-based buffer overflow in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• Stack-based buffer overflow in IBM Maximo Application Suite - Monitor Component update for Netty
• Stack-based buffer overflow in IBM InfoSphere Master Data Management
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client, IBM Storage Protect for Virtual Environments and IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Application Performance Management