IBM WebSphere Liberty HTTP/2 DoS Vulnerability Advisory (CVE-2026-11897)

Vulnerability Overview IBM WebSphere Application Server Liberty is affected by an HTTP/2 Denial of Service vulnerability (CVE-2026-11897). When the servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 features are enabled, a remote attacker can exploit this vulnerability by sending crafted requests, causing the server to consume memory resources. Affected Range Affected Product: WebSphere Application Server - Liberty 17.0.0.3 - 26.0.0.7 CVSS Base Score: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Remediation IBM strongly recommends applying an available interim fix or a fix pack containing the fix to address this vulnerability. The specific steps are as follows: 1. For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.7 using servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 features: - Upgrade to the required interim fix level, and then apply the interim fix addressing PH71939. - Alternatively, apply Liberty Fix Pack 26.0.0.8 or later (target availability in Q2 2026). 2. Other Interim Fixes: There may be other interim fixes available, linked to the interim fix download page. References Reference Links: - Complete CVSS v3 Guide - Online Calculator v3 Additional Information Modification Date: July 22, 2026 Initial Publication Date: July 21, 2026 UID: ibm17280695 Disclaimer IBM provides the vulnerability score “AS IS” without any express or implied warranty, based on standards such as the Forum of Incident Response and Security Teams (FIRST) and the Common Vulnerability Scoring System (CVSS). Customers should assess the impact of this vulnerability on their environment. Document Location Global: - Business Unit: SSE0P - Product: WebSphere Application Server - Component: Liberty - Platform: AIX, Linux, Windows, z/OS, Mac OS - Version: Liberty - Edition: Liberty - Business Line: LOB77 - Platform: Automation Platform Feedback and Support Share Feedback: Submit Feedback Need Support?：1-800-IBM-7378 (USA) Global Contact Information

Goal Reached Thanks to every supporter — we hit 100%!

IBM WebSphere Liberty HTTP/2 DoS Vulnerability Advisory (CVE-2026-11897)