CVE-2026-8646 is HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0 and Liberty 17.0.0.3 through 26.0.0.6 (CVSS 7.4, high). IBM offers interim fixes for APARs PH71631 and PH71370 and later fix packs. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
IBM lists WebSphere Application Server 9.0 and 8.5, and Liberty 17.0.0.3 through 26.0.0.6. The weakness is CWE-444, inconsistent interpretation of HTTP requests. For Liberty, the bulletin applies to servlet 3.0 to 6.1 and websocket 1.0 to 2.2 features.
Fixes named by IBM: for Liberty, the interim fix for PH71631 or fix pack 26.0.0.7 or later. For traditional 9.0.0.0 through 9.0.5.28, the interim fix for PH71370 or fix pack 9.0.5.29. For 8.5.0.0 through 8.5.5.29, the interim fix for PH71370 or fix pack 8.5.5.30. IBM notes the fix packs had a targeted availability of third quarter 2026, so check their status. No workaround is listed. The record is not in the CISA KEV catalog.
How to check if you're exposed
For traditional WebSphere, read the version.
/opt/IBM/WebSphere/AppServer/bin/versionInfo.sh
For Liberty, check the runtime version and which features are enabled in server.xml. Compare both with the ranges above.
What to do now
- Apply the interim fix for PH71370 on traditional WebSphere, or the matching fix pack when available.
- Apply the interim fix for PH71631 on Liberty, or fix pack 26.0.0.7 or later.
- Check which Liberty features are enabled to confirm exposure.
- Keep front end proxies and load balancers at current versions, since smuggling depends on how two systems read one request.
- Review the same IBM bulletin for the related denial of service entries.
Why it matters
Request smuggling happens when a front end and a back end disagree about where one request ends and the next begins. An attacker hides a second request inside the first, and it slips past controls applied by the front end.
The consequences listed by IBM include bypassing security controls, spoofing identity and exposing information. Fixes come from both sides: patch the server and keep proxies strict about malformed requests.
Quick check
Is there a workaround?
The IBM bulletin lists none, so apply the interim fix or fix pack.
Sources
Last reviewed: 19 October 2026.
