Inconsistent interpretation of HTTP requests in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - CVE-2026-11541

Vulnerability identifier: #VU135124

CSH Severity: High

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-11541

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

IBM WebSphere Application Server
IBM WebSphere Application Server Liberty
IBM Business Automation Workflow
Jazz for Service Management
IBM SPSS Analytic Server
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM TXSeries for Multiplatforms
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM MQ
IBM Rational ClearQuest
IBM Sterling Transformation Extender
Enterprise Application Runtimes
PowerVM NovaLink
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
IBM OpenPages with Watson
CICS Transaction Gateway Desktop Edition
IBM MQ Appliance
Voice Gateway
IBM Watson Explorer Foundational Components
IBM Watson Explorer Analytical Components

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29
IBM WebSphere Application Server Liberty - update to 26.0.0.7
Voice Gateway - addressed in versions 1.0.8.21, 1.0.8.29
PowerVM NovaLink - addressed in versions 2.2.1.1-260708, 2.3.3-260714
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix22
IBM MQ - addressed in versions 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26, 10.0.0.5
IBM MQ Appliance - addressed in versions 9.4.0.26, 9.4.5.3, 10.0.0.5
IBM Watson Explorer Foundational Components - update to 12.0.3.22 PH71585
IBM Watson Explorer Analytical Components - update to 12.0.3.22 PH71585

• https://www.ibm.com/support/pages/node/7277550

• Inconsistent interpretation of HTTP requests in IBM WebSphere Application Server and WebSphere Application Server Liberty
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Inconsistent interpretation of HTTP requests in IBM WebSphere Remote Server
• Inconsistent interpretation of HTTP requests in IBM Guardium Key Lifecycle Manager (SKLM/GKLM)
• Multiple vulnerabilities in IBM Buinses Automation Workflow
• Inconsistent interpretation of HTTP requests in IBM Cloud Pak for Applications
• Inconsistent interpretation of HTTP requests in IBM Enterprise Application Runtimes
• Inconsistent interpretation of HTTP requests in IBM WebSphere Hybrid Edition
• Inconsistent interpretation of HTTP requests in IBM Tivoli Composite Application Manager for Application Diagnostics
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM PowerVM Novalink
• Inconsistent interpretation of HTTP requests in IBM Tivoli System Automation Application Manager
• Inconsistent interpretation of HTTP requests in IBM Rational ClearQuest
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM SPSS Analytic Server
• Inconsistent interpretation of HTTP requests in IBM Watson Explorer
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Voice Gateway
• Inconsistent interpretation of HTTP requests in IBM Jazz for Service Management
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Inconsistent interpretation of HTTP requests in IBM Sterling Transformation Extender Advance
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM MQ Appliance
• Inconsistent interpretation of HTTP requests in IBM MQ