CVE-2025-36097 - IBM WebSphere Application Server denial of service

Back Back to CVE browser

HIGH

IBM WebSphere Application Server denial of service

Published Jul 16, 2025

7.5

HIGH

CVSS 3.1

EPSS 0.46%

Description

IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources.

Affected products

Vendor IBM Product WebSphere Application Server Default
unaffected
- Version
  9.0
  Status
  affected
  Constraints
  -
Vendor IBM Product WebSphere Application Server Liberty Default
unaffected
- Version
  17.0.0.3
  Status
  affected
  Constraints
  <=25.0.0.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

WebSphere Application Server

unaffected

Version	Status	Constraints
9.0	affected	-

IBM

WebSphere Application Server Liberty

unaffected

Version	Status	Constraints
17.0.0.3	affected	<=25.0.0.7

Remediation

Vendor solution

For IBM WebSphere Application Server Liberty 17.0.0.3 - 25.0.0.7 using the jsonp-1.0, jsonp-1.1, or jsonp-2.0 feature:

· Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH67183 --OR-- · Apply Fix Pack 25.0.0.8 or later (targeted availability 3Q2025).

For IBM WebSphere Application Server traditional:

For V9.0.0.0 through 9.0.5.24: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH67120 --OR-- · Apply Fix Pack 9.0.5.25 or later (targeted availability 3Q2025).

Additional interim fixes may be available and linked off the interim fix download page.

Weaknesses (1)

CWE-121