Allocation of Resources Without Limits or Throttling in IBM WebSphere Application Server - CVE-2025-36099

Vulnerability identifier: #VU116602

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-36099

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote privileged user can trigger resource exhaustion and perform a denial of service (DoS) attack.

IBM WebSphere Application Server
IBM Business Automation Workflow
Jazz for Service Management
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
IBM Maximo Asset Management
WebSphere Service Registry and Repository
WebSphere Remote Server
IBM Rational ClearQuest
IBM Rational ClearCase
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
Tivoli Network Configuration Manager IP Edition
Tivoli Composite Application Manager for Application Diagnostics
Business Monitor
DevOps Code ClearCase

Install updates from vendor's website.

Tivoli Network Manager IP Edition - update to 4.2.0.23
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
Tivoli Network Configuration Manager IP Edition - update to 6.4.2.23

• https://www.ibm.com/support/pages/node/7246549

• Allocation of resources without limits or throttling in IBM WebSphere Application Server
• Allocation of resources without limits or throttling in IBM Business Monitor
• Allocation of resources without limits or throttling in Tivoli Composite Application Manager for Application Diagnostics
• Allocation of resources without limits or throttling in IBM Tivoli System Automation Application Manager
• Allocation of resources without limits or throttling in IBM Jazz for Service Management
• Allocation of resources without limits or throttling in IBM Business Automation Workflow traditional and IBM Business Automation Workflow Enterprise Service Bus
• Allocation of resources without limits or throttling in IBM WebSphere Remote Server
• Allocation of resources without limits or throttling in IBM WebSphere Service Registry and Repository
• Allocation of resources without limits or throttling in IBM Maximo Asset Management
• Allocation of resources without limits or throttling in IBM Cloud Pak for Applications
• Allocation of resources without limits or throttling in IBM Enterprise Application Runtimes
• Allocation of resources without limits or throttling in IBM WebSphere Hybrid Edition
• Allocation of resources without limits or throttling in IBM Tivoli Network Manager IP Edition
• Allocation of resources without limits or throttling in IBM Tivoli Network Configuration Manager
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Allocation of Resources Without Limits or Throttling in IBM Rational ClearQuest