CVE-2016-8919 — IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources

Back Back to CVE browser

HIGH

IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources

Published Feb 1, 2017

7.5

HIGH

CVSS 3.0

EPSS 2.83%

Description

IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.

Affected products

Vendor IBM Corporation Product WebSphere Application Server Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.0.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.1.1
  Status
  affected
  Constraints
  -
- Version
  1.0.1.2
  Status
  affected
  Constraints
  -
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.1.0.2
  Status
  affected
  Constraints
  -
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  3.0
  Status
  affected
  Constraints
  -
- Version
  3.0.0.3
  Status
  affected
  Constraints
  -
- Version
  3.0.0.4
  Status
  affected
  Constraints
  -
- Version
  3.0.2
  Status
  affected
  Constraints
  -
- Version
  3.0.2.1
  Status
  affected
  Constraints
  -
- Version
  3.0.2.2
  Status
  affected
  Constraints
  -
- Version
  3.0.2.3
  Status
  affected
  Constraints
  -
- Version
  3.0.2.4
  Status
  affected
  Constraints
  -
- Version
  3.0.21
  Status
  affected
  Constraints
  -
- Version
  3.5
  Status
  affected
  Constraints
  -
- Version
  3.5.1
  Status
  affected
  Constraints
  -
- Version
  3.5.2
  Status
  affected
  Constraints
  -
- Version
  3.5.3
  Status
  affected
  Constraints
  -
- Version
  3.52
  Status
  affected
  Constraints
  -
- Version
  4.0.1
  Status
  affected
  Constraints
  -
- Version
  4.0.2
  Status
  affected
  Constraints
  -
- Version
  4.0.3
  Status
  affected
  Constraints
  -
- Version
  4.0.4
  Status
  affected
  Constraints
  -
- Version
  5.0
  Status
  affected
  Constraints
  -
- Version
  5.0.0
  Status
  affected
  Constraints
  -
- Version
  5.0.1
  Status
  affected
  Constraints
  -
- Version
  5.0.2
  Status
  affected
  Constraints
  -
- Version
  5.0.2.1
  Status
  affected
  Constraints
  -
- Version
  5.0.2.10
  Status
  affected
  Constraints
  -
- Version
  5.0.2.11
  Status
  affected
  Constraints
  -
- Version
  5.0.2.12
  Status
  affected
  Constraints
  -
- Version
  5.0.2.13
  Status
  affected
  Constraints
  -
- Version
  5.0.2.14
  Status
  affected
  Constraints
  -
- Version
  5.0.2.15
  Status
  affected
  Constraints
  -
- Version
  5.0.2.16
  Status
  affected
  Constraints
  -
- Version
  5.0.2.2
  Status
  affected
  Constraints
  -
- Version
  5.0.2.3
  Status
  affected
  Constraints
  -
- Version
  5.0.2.4
  Status
  affected
  Constraints
  -
- Version
  5.0.2.5
  Status
  affected
  Constraints
  -
- Version
  5.0.2.6
  Status
  affected
  Constraints
  -
- Version
  5.0.2.7
  Status
  affected
  Constraints
  -
- Version
  5.0.2.8
  Status
  affected
  Constraints
  -
- Version
  5.0.2.9
  Status
  affected
  Constraints
  -
- Version
  5.1
  Status
  affected
  Constraints
  -
- Version
  5.1.0.1
  Status
  affected
  Constraints
  -
- Version
  5.1.0.2
  Status
  affected
  Constraints
  -
- Version
  5.1.0.3
  Status
  affected
  Constraints
  -
- Version
  5.1.0.4
  Status
  affected
  Constraints
  -
- Version
  5.1.0.5
  Status
  affected
  Constraints
  -
- Version
  5.1.1
  Status
  affected
  Constraints
  -
- Version
  5.1.1.1
  Status
  affected
  Constraints
  -
- Version
  5.1.1.10
  Status
  affected
  Constraints
  -
- Version
  5.1.1.11
  Status
  affected
  Constraints
  -
- Version
  5.1.1.12
  Status
  affected
  Constraints
  -
- Version
  5.1.1.13
  Status
  affected
  Constraints
  -
- Version
  5.1.1.14
  Status
  affected
  Constraints
  -
- Version
  5.1.1.15
  Status
  affected
  Constraints
  -
- Version
  5.1.1.16
  Status
  affected
  Constraints
  -
- Version
  5.1.1.17
  Status
  affected
  Constraints
  -
- Version
  5.1.1.18
  Status
  affected
  Constraints
  -
- Version
  5.1.1.2
  Status
  affected
  Constraints
  -
- Version
  5.1.1.3
  Status
  affected
  Constraints
  -
- Version
  5.1.1.4
  Status
  affected
  Constraints
  -
- Version
  5.1.1.5
  Status
  affected
  Constraints
  -
- Version
  5.1.1.6
  Status
  affected
  Constraints
  -
- Version
  5.1.1.7
  Status
  affected
  Constraints
  -
- Version
  5.1.1.8
  Status
  affected
  Constraints
  -
- Version
  5.1.1.9
  Status
  affected
  Constraints
  -
- Version
  5.3
  Status
  affected
  Constraints
  -
- Version
  6.0
  Status
  affected
  Constraints
  -
- Version
  6.0.0.1
  Status
  affected
  Constraints
  -
- Version
  6.0.0.2
  Status
  affected
  Constraints
  -
- Version
  6.0.0.3
  Status
  affected
  Constraints
  -
- Version
  6.0.1
  Status
  affected
  Constraints
  -
- Version
  6.0.1.1
  Status
  affected
  Constraints
  -
- Version
  6.0.1.11
  Status
  affected
  Constraints
  -
- Version
  6.0.1.13
  Status
  affected
  Constraints
  -
- Version
  6.0.1.15
  Status
  affected
  Constraints
  -
- Version
  6.0.1.17
  Status
  affected
  Constraints
  -
- Version
  6.0.1.2
  Status
  affected
  Constraints
  -
- Version
  6.0.1.3
  Status
  affected
  Constraints
  -
- Version
  6.0.1.5
  Status
  affected
  Constraints
  -
- Version
  6.0.1.7
  Status
  affected
  Constraints
  -
- Version
  6.0.1.9
  Status
  affected
  Constraints
  -
- Version
  6.0.2
  Status
  affected
  Constraints
  -
- Version
  6.0.2.1
  Status
  affected
  Constraints
  -
- Version
  6.0.2.10
  Status
  affected
  Constraints
  -
- Version
  6.0.2.11
  Status
  affected
  Constraints
  -
- Version
  6.0.2.12
  Status
  affected
  Constraints
  -
- Version
  6.0.2.13
  Status
  affected
  Constraints
  -
- Version
  6.0.2.14
  Status
  affected
  Constraints
  -
- Version
  6.0.2.15
  Status
  affected
  Constraints
  -
- Version
  6.0.2.16
  Status
  affected
  Constraints
  -
- Version
  6.0.2.17
  Status
  affected
  Constraints
  -
- Version
  6.0.2.18
  Status
  affected
  Constraints
  -
- Version
  6.0.2.19
  Status
  affected
  Constraints
  -
- Version
  6.0.2.2
  Status
  affected
  Constraints
  -
- Version
  6.0.2.20
  Status
  affected
  Constraints
  -
- Version
  6.0.2.21
  Status
  affected
  Constraints
  -
- Version
  6.0.2.22
  Status
  affected
  Constraints
  -
- Version
  6.0.2.23
  Status
  affected
  Constraints
  -
- Version
  6.0.2.24
  Status
  affected
  Constraints
  -
- Version
  6.0.2.25
  Status
  affected
  Constraints
  -
- Version
  6.0.2.26
  Status
  affected
  Constraints
  -
- Version
  6.0.2.27
  Status
  affected
  Constraints
  -
- Version
  6.0.2.28
  Status
  affected
  Constraints
  -
- Version
  6.0.2.29
  Status
  affected
  Constraints
  -
- Version
  6.0.2.3
  Status
  affected
  Constraints
  -
- Version
  6.0.2.30
  Status
  affected
  Constraints
  -
- Version
  6.0.2.31
  Status
  affected
  Constraints
  -
- Version
  6.0.2.32
  Status
  affected
  Constraints
  -
- Version
  6.0.2.33
  Status
  affected
  Constraints
  -
- Version
  6.0.2.35
  Status
  affected
  Constraints
  -
- Version
  6.0.2.37
  Status
  affected
  Constraints
  -
- Version
  6.0.2.39
  Status
  affected
  Constraints
  -
- Version
  6.0.2.4
  Status
  affected
  Constraints
  -
- Version
  6.0.2.5
  Status
  affected
  Constraints
  -
- Version
  6.0.2.6
  Status
  affected
  Constraints
  -
- Version
  6.0.2.7
  Status
  affected
  Constraints
  -
- Version
  6.0.2.8
  Status
  affected
  Constraints
  -
- Version
  6.0.2.9
  Status
  affected
  Constraints
  -
- Version
  6.1
  Status
  affected
  Constraints
  -
- Version
  6.1.0
  Status
  affected
  Constraints
  -
- Version
  6.1.0.0
  Status
  affected
  Constraints
  -
- Version
  6.1.0.1
  Status
  affected
  Constraints
  -
- Version
  6.1.0.10
  Status
  affected
  Constraints
  -
- Version
  6.1.0.11
  Status
  affected
  Constraints
  -
- Version
  6.1.0.12
  Status
  affected
  Constraints
  -
- Version
  6.1.0.13
  Status
  affected
  Constraints
  -
- Version
  6.1.0.14
  Status
  affected
  Constraints
  -
- Version
  6.1.0.15
  Status
  affected
  Constraints
  -
- Version
  6.1.0.16
  Status
  affected
  Constraints
  -
- Version
  6.1.0.17
  Status
  affected
  Constraints
  -
- Version
  6.1.0.18
  Status
  affected
  Constraints
  -
- Version
  6.1.0.19
  Status
  affected
  Constraints
  -
- Version
  6.1.0.2
  Status
  affected
  Constraints
  -
- Version
  6.1.0.20
  Status
  affected
  Constraints
  -
- Version
  6.1.0.21
  Status
  affected
  Constraints
  -
- Version
  6.1.0.22
  Status
  affected
  Constraints
  -
- Version
  6.1.0.23
  Status
  affected
  Constraints
  -
- Version
  6.1.0.24
  Status
  affected
  Constraints
  -
- Version
  6.1.0.25
  Status
  affected
  Constraints
  -
- Version
  6.1.0.26
  Status
  affected
  Constraints
  -
- Version
  6.1.0.27
  Status
  affected
  Constraints
  -
- Version
  6.1.0.29
  Status
  affected
  Constraints
  -
- Version
  6.1.0.3
  Status
  affected
  Constraints
  -
- Version
  6.1.0.31
  Status
  affected
  Constraints
  -
- Version
  6.1.0.33
  Status
  affected
  Constraints
  -
- Version
  6.1.0.35
  Status
  affected
  Constraints
  -
- Version
  6.1.0.37
  Status
  affected
  Constraints
  -
- Version
  6.1.0.39
  Status
  affected
  Constraints
  -
- Version
  6.1.0.4
  Status
  affected
  Constraints
  -
- Version
  6.1.0.41
  Status
  affected
  Constraints
  -
- Version
  6.1.0.5
  Status
  affected
  Constraints
  -
- Version
  6.1.0.6
  Status
  affected
  Constraints
  -
- Version
  6.1.0.7
  Status
  affected
  Constraints
  -
- Version
  6.1.0.8
  Status
  affected
  Constraints
  -
- Version
  6.1.0.9
  Status
  affected
  Constraints
  -
- Version
  6.1.1
  Status
  affected
  Constraints
  -
- Version
  6.1.13
  Status
  affected
  Constraints
  -
- Version
  6.1.14
  Status
  affected
  Constraints
  -
- Version
  6.1.3
  Status
  affected
  Constraints
  -
- Version
  6.1.5
  Status
  affected
  Constraints
  -
- Version
  6.1.6
  Status
  affected
  Constraints
  -
- Version
  6.1.7
  Status
  affected
  Constraints
  -
- Version
  6.10.17
  Status
  affected
  Constraints
  -
- Version
  6.1W
  Status
  affected
  Constraints
  -
- Version
  7.0
  Status
  affected
  Constraints
  -
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.0.1
  Status
  affected
  Constraints
  -
- Version
  7.0.0.11
  Status
  affected
  Constraints
  -
- Version
  7.0.0.13
  Status
  affected
  Constraints
  -
- Version
  7.0.0.15
  Status
  affected
  Constraints
  -
- Version
  7.0.0.17
  Status
  affected
  Constraints
  -
- Version
  7.0.0.19
  Status
  affected
  Constraints
  -
- Version
  7.0.0.2
  Status
  affected
  Constraints
  -
- Version
  7.0.0.21
  Status
  affected
  Constraints
  -
- Version
  7.0.0.23
  Status
  affected
  Constraints
  -
- Version
  7.0.0.3
  Status
  affected
  Constraints
  -
- Version
  7.0.0.4
  Status
  affected
  Constraints
  -
- Version
  7.0.0.5
  Status
  affected
  Constraints
  -
- Version
  7.0.0.6
  Status
  affected
  Constraints
  -
- Version
  7.0.0.7
  Status
  affected
  Constraints
  -
- Version
  7.0.0.8
  Status
  affected
  Constraints
  -
- Version
  7.0.0.9
  Status
  affected
  Constraints
  -
- Version
  7.1
  Status
  affected
  Constraints
  -
- Version
  7.2
  Status
  affected
  Constraints
  -
- Version
  8.0
  Status
  affected
  Constraints
  -
- Version
  8.0.0
  Status
  affected
  Constraints
  -
- Version
  8.0.0.0
  Status
  affected
  Constraints
  -
- Version
  8.0.0.1
  Status
  affected
  Constraints
  -
- Version
  8.5
  Status
  affected
  Constraints
  -
- Version
  8.5.5
  Status
  affected
  Constraints
  -
- Version
  9.0
  Status
  affected
  Constraints
  -
- Version
  9.0.0.0
  Status
  affected
  Constraints
  -
- Version
  Applicable
  Status
  affected
  Constraints
  -
- Version
  Not
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM Corporation

WebSphere Application Server

n/a

Version	Status	Constraints
1.0	affected	-
1.0.0.1	affected	-
1.0.1	affected	-
1.0.1.1	affected	-
1.0.1.2	affected	-
1.1	affected	-
1.1.0.1	affected	-
1.1.0.2	affected	-
2.0	affected	-
2.1	affected	-
3.0	affected	-
3.0.0.3	affected	-
3.0.0.4	affected	-
3.0.2	affected	-
3.0.2.1	affected	-
3.0.2.2	affected	-
3.0.2.3	affected	-
3.0.2.4	affected	-
3.0.21	affected	-
3.5	affected	-
3.5.1	affected	-
3.5.2	affected	-
3.5.3	affected	-
3.52	affected	-
4.0.1	affected	-
4.0.2	affected	-
4.0.3	affected	-
4.0.4	affected	-
5.0	affected	-
5.0.0	affected	-
5.0.1	affected	-
5.0.2	affected	-
5.0.2.1	affected	-
5.0.2.10	affected	-
5.0.2.11	affected	-
5.0.2.12	affected	-
5.0.2.13	affected	-
5.0.2.14	affected	-
5.0.2.15	affected	-
5.0.2.16	affected	-
5.0.2.2	affected	-
5.0.2.3	affected	-
5.0.2.4	affected	-
5.0.2.5	affected	-
5.0.2.6	affected	-
5.0.2.7	affected	-
5.0.2.8	affected	-
5.0.2.9	affected	-
5.1	affected	-
5.1.0.1	affected	-
5.1.0.2	affected	-
5.1.0.3	affected	-
5.1.0.4	affected	-
5.1.0.5	affected	-
5.1.1	affected	-
5.1.1.1	affected	-
5.1.1.10	affected	-
5.1.1.11	affected	-
5.1.1.12	affected	-
5.1.1.13	affected	-
5.1.1.14	affected	-
5.1.1.15	affected	-
5.1.1.16	affected	-
5.1.1.17	affected	-
5.1.1.18	affected	-
5.1.1.2	affected	-
5.1.1.3	affected	-
5.1.1.4	affected	-
5.1.1.5	affected	-
5.1.1.6	affected	-
5.1.1.7	affected	-
5.1.1.8	affected	-
5.1.1.9	affected	-
5.3	affected	-
6.0	affected	-
6.0.0.1	affected	-
6.0.0.2	affected	-
6.0.0.3	affected	-
6.0.1	affected	-
6.0.1.1	affected	-
6.0.1.11	affected	-
6.0.1.13	affected	-
6.0.1.15	affected	-
6.0.1.17	affected	-
6.0.1.2	affected	-
6.0.1.3	affected	-
6.0.1.5	affected	-
6.0.1.7	affected	-
6.0.1.9	affected	-
6.0.2	affected	-
6.0.2.1	affected	-
6.0.2.10	affected	-
6.0.2.11	affected	-
6.0.2.12	affected	-
6.0.2.13	affected	-
6.0.2.14	affected	-
6.0.2.15	affected	-
6.0.2.16	affected	-
6.0.2.17	affected	-
6.0.2.18	affected	-
6.0.2.19	affected	-
6.0.2.2	affected	-
6.0.2.20	affected	-
6.0.2.21	affected	-
6.0.2.22	affected	-
6.0.2.23	affected	-
6.0.2.24	affected	-
6.0.2.25	affected	-
6.0.2.26	affected	-
6.0.2.27	affected	-
6.0.2.28	affected	-
6.0.2.29	affected	-
6.0.2.3	affected	-
6.0.2.30	affected	-
6.0.2.31	affected	-
6.0.2.32	affected	-
6.0.2.33	affected	-
6.0.2.35	affected	-
6.0.2.37	affected	-
6.0.2.39	affected	-
6.0.2.4	affected	-
6.0.2.5	affected	-
6.0.2.6	affected	-
6.0.2.7	affected	-
6.0.2.8	affected	-
6.0.2.9	affected	-
6.1	affected	-
6.1.0	affected	-
6.1.0.0	affected	-
6.1.0.1	affected	-
6.1.0.10	affected	-
6.1.0.11	affected	-
6.1.0.12	affected	-
6.1.0.13	affected	-
6.1.0.14	affected	-
6.1.0.15	affected	-
6.1.0.16	affected	-
6.1.0.17	affected	-
6.1.0.18	affected	-
6.1.0.19	affected	-
6.1.0.2	affected	-
6.1.0.20	affected	-
6.1.0.21	affected	-
6.1.0.22	affected	-
6.1.0.23	affected	-
6.1.0.24	affected	-
6.1.0.25	affected	-
6.1.0.26	affected	-
6.1.0.27	affected	-
6.1.0.29	affected	-
6.1.0.3	affected	-
6.1.0.31	affected	-
6.1.0.33	affected	-
6.1.0.35	affected	-
6.1.0.37	affected	-
6.1.0.39	affected	-
6.1.0.4	affected	-
6.1.0.41	affected	-
6.1.0.5	affected	-
6.1.0.6	affected	-
6.1.0.7	affected	-
6.1.0.8	affected	-
6.1.0.9	affected	-
6.1.1	affected	-
6.1.13	affected	-
6.1.14	affected	-
6.1.3	affected	-
6.1.5	affected	-
6.1.6	affected	-
6.1.7	affected	-
6.10.17	affected	-
6.1W	affected	-
7.0	affected	-
7.0.0	affected	-
7.0.0.1	affected	-
7.0.0.11	affected	-
7.0.0.13	affected	-
7.0.0.15	affected	-
7.0.0.17	affected	-
7.0.0.19	affected	-
7.0.0.2	affected	-
7.0.0.21	affected	-
7.0.0.23	affected	-
7.0.0.3	affected	-
7.0.0.4	affected	-
7.0.0.5	affected	-
7.0.0.6	affected	-
7.0.0.7	affected	-
7.0.0.8	affected	-
7.0.0.9	affected	-
7.1	affected	-
7.2	affected	-
8.0	affected	-
8.0.0	affected	-
8.0.0.0	affected	-
8.0.0.1	affected	-
8.5	affected	-
8.5.5	affected	-
9.0	affected	-
9.0.0.0	affected	-
Applicable	affected	-
Not	affected	-
unspecified	affected	-

Remediation

No remediation recorded yet.

Metrics

2.83% 0.02828

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02828

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.83% (0.02828)	86.11th	v5 (v2026.06.15)
Jun 15, 2026	2.83% (0.02828)	84.71th	v5 (v2026.06.15)
Mar 17, 2025	0.86% (0.00859)	73.42th	v4 (v2025.03.14)
Dec 12, 2024	0.22% (0.00225)	61.67th	v3 (v2023.03.01)
Jun 13, 2024	0.22% (0.00225)	60.92th	v3 (v2023.03.01)
Mar 7, 2023	0.22% (0.00225)	58.90th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00954)	36.37th	v2 (v2022.01.01)
Sep 2, 2022	0.95% (0.00954)	34.50th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00954)	32.50th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00954)	16.28th	v2 (v2022.01.01)

Weaknesses (1)

CWE-399

References (3)

http://www.ibm.com/support/docview.wss?uid=swg21993797
x_refsource_CONFIRMPatchVendor Advisory
http://www.securityfocus.com/bid/95650
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037710
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.ibm.com/support/docview.wss?uid=swg21993797		x_refsource_CONFIRMPatchVendor Advisory
http://www.securityfocus.com/bid/95650		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037710		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Feb 1, 2017

Updated Aug 6, 2024

Reserved Oct 25, 2016

Link CVE-2016-8919

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-8919

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-8919