Resource exhaustion in IBM WebSphere Application Server Liberty and IBM WebSphere Application Server - CVE-2026-9171
Published: July 2, 2026
Vulnerability identifier: #VU136794
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-9171
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
IBM WebSphere Application Server Liberty
IBM WebSphere Application Server
PowerVM NovaLink
Tivoli Network Manager IP Edition
Enterprise Application Runtimes
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM License Metric Tool
IBM Watson Explorer Foundational Components
IBM Watson Explorer Analytical Components
IBM WebSphere Application Server
PowerVM NovaLink
Tivoli Network Manager IP Edition
Enterprise Application Runtimes
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM License Metric Tool
IBM Watson Explorer Foundational Components
IBM Watson Explorer Analytical Components
How to mitigate CVE-2026-9171
Install updates from vendor's website.
IBM WebSphere Application Server Liberty - update to 26.0.0.8
IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29
PowerVM NovaLink - addressed in versions 2.2.1.1-260708, 2.3.3-260714
IBM Watson Explorer Foundational Components - update to 12.0.3.22 PH71585
IBM Watson Explorer Analytical Components - update to 12.0.3.22 PH71585
IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29
PowerVM NovaLink - addressed in versions 2.2.1.1-260708, 2.3.3-260714
IBM Watson Explorer Foundational Components - update to 12.0.3.22 PH71585
IBM Watson Explorer Analytical Components - update to 12.0.3.22 PH71585
External References
Related Security Bulletins
- Multiple vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty
- Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager (GKLM)
- Multiple vulnerabilities in IBM Enterprise Application Runtimes
- Multiple vulnerabilities in IBM WebSphere Remote Server
- Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
- Multiple vulnerabilities in IBM PowerVM Novalink
- Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
- Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
- Multiple vulnerabilities in IBM Watson Explorer
- Multiple vulnerabilities in IBM Rational ClearQuest
- Multiple vulnerabilities in IBM License Metric Tool
- Multiple vulnerabilities in IBM Tivoli System Automation Application Manager