Brief Summary: CVE-2026-8620 HTTP Request Smuggling in IBM WebSphere Web Server Plug-ins

Introduction

A newly disclosed HTTP request smuggling flaw in IBM's Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty lets a remote, unauthenticated attacker slip crafted requests past the plug-in layer and into the back-end application server, with high confidentiality impact across security boundaries. It shares an advisory with CVE-2026-8633, a CVSS 9.8 remote code execution vulnerability in the same plug-in component, and IBM has confirmed that no workarounds exist for either issue.

Technical Information

Root Cause: Inconsistent HTTP Request Parsing (CWE-444)

CVE-2026-8620 falls under CWE-444: Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling. The vulnerability is in the IBM Web Server Plug-ins, the intermediary layer between front-end web servers (such as Apache HTTP Server, IBM HTTP Server, or Microsoft IIS) and the back-end WebSphere Application Server or WebSphere Liberty runtime. The plug-in receives HTTP requests from the front-end server and forwards them to the appropriate back-end application server instance.

The plug-in does not interpret malformed or ambiguous HTTP requests the same way the destination application server does. When an HTTP message contains conflicting or duplicate Transfer-Encoding (TE) and Content-Length (CL) headers, the plug-in and the back-end server may disagree on where one request ends and the next begins. HTTP request smuggling is built on that disagreement.

Smuggling Techniques

Two main smuggling patterns apply to this class of vulnerability:

In both cases, the attacker hides a second HTTP request inside what the plug-in treats as a single legitimate request. The back-end application server draws the request boundaries differently and processes the smuggled request as a separate, independent request. That request inherits the security context and trust level of the front-end connection.

CVSS Vector Analysis

The CVSS v3.1 base score is 7.5, with vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. Each component says something about the attack:

• AV:N (Network): The attack works remotely.
• AC:H (High Complexity): Exploitation requires specific conditions, likely tied to the particular TE/CL header combination and the specific front-end/back-end configuration.
• PR:N / UI:N: No authentication or user interaction is required.
• S:C (Changed Scope): The plug-in is designed to be a trust boundary, and this vulnerability breaks that boundary. Exploitation reaches resources beyond the plug-in's own security authority, which means the wider application server environment and its data.
• C:H / I:L / A:N: High confidentiality impact, low integrity impact, and no availability impact, consistent with smuggling attacks that can expose sensitive data or poison caches.

Exploitation Consequences

According to MITRE's CWE-444 documentation, successful HTTP request smuggling enables three main categories of attack:

1. Web Cache Poisoning: The attacker tricks the web server or an intermediate cache into associating a malicious URL with a legitimate page's content, so every later user who requests that URL gets the poisoned response.
2. Firewall/WAF Bypass: The attacker smuggles malicious payloads (such as command execution patterns or injection strings) through web application firewalls by embedding them in header values that the firewall treats as part of a benign request.
3. Credential Theft via XSS Facilitation: Smuggled requests can invoke scripts or redirect responses in ways that expose client credentials to the attacker.

The Companion RCE: CVE-2026-8633

The IBM security bulletin that discloses CVE-2026-8620 also covers CVE-2026-8633, a CVSS 9.8 remote code execution vulnerability (CWE-94: Improper Control of Generation of Code) in the same Web Server Plug-ins component. Having a request smuggling flaw and an RCE in one component opens a possible chain: an attacker could use the smuggling vulnerability to get past perimeter defenses, then use the RCE to execute code on the back-end server. The APAR PH71342 fix resolves both vulnerabilities.

Discovery Attribution

Positive Technologies discovered the vulnerability, which is tracked as PT-2026-43363 in the dbugs vulnerability database. The GitHub Advisory Database lists it as GHSA-qwgm-xj6f-w5v6.

Patch Information

IBM has released an official fix under APAR PH71342, published on May 26, 2026. The Web Server Plug-ins are a proprietary, closed-source component, so the fix ships as IBM Installation Manager interim fix packages downloadable from IBM Fix Central rather than as a public code commit.

The fix corrects the parsing inconsistency, so the plug-in now normalizes and validates HTTP requests before forwarding them to the back-end application server.

Two interim fix packages are available now:

Note on the V8.5 interim fix: The first release of the 8.5.x interim fix did not apply correctly to version 8.5.5.29. IBM replaced the package the same day (May 26, 2026) with an updated build, identifiable by the 20260526 date string in the filename. Administrators should confirm they have the corrected package.

Prerequisites: Administrators must upgrade to the minimum fix pack level the interim fix requires (at least 9.0.5.24 for the V9.0 line, or 8.5.5.25 for the V8.5 line) before they can apply it.

For organizations that would rather wait for a full fix pack, IBM has targeted the PH71342 fix for inclusion in:

• Fix Pack 9.0.5.28, targeted for 2Q 2026
• Fix Pack 8.5.5.30, targeted for 3Q 2026

Given the CVSS 7.5 severity, the lack of any workaround, and the fact that the same APAR also patches the companion CVE-2026-8633 (CVSS 9.8 RCE), apply the interim fix now rather than waiting for the full fix packs.

IBM lists "None" under workarounds and mitigations. It does not endorse configuration-level defenses such as WAF rules, header normalization, or proxy-layer sanitization as sufficient. Patching is the only confirmed remediation path.

Affected Systems and Versions

The vulnerability affects these IBM Web Server Plug-ins versions on all supported platforms:

Supported Platforms: AIX, IBM i, Linux, Windows, z/OS, and Mac OS.

The Web Server Plug-ins are an optional, separately installable component, so not every WebSphere deployment is exposed. Only deployments that use the plug-in architecture for web server integration are affected. Organizations should inventory their WebSphere environments to find out whether the plug-in component is deployed.

Vendor Security History

IBM has a documented history of HTTP request smuggling vulnerabilities in its web infrastructure products. The closest precedent is CVE-2015-3183, which affected IBM HTTP Server (powered by Apache) across all editions of WebSphere Application Server from V6.1 through V8.5.5.6. That vulnerability shared several characteristics with CVE-2026-8620:

The same vulnerability class has turned up in different IBM web infrastructure components over an 11-year span, which suggests a systemic pattern in IBM's HTTP message parsing implementations. Neither case had a workaround, which further indicates that the vulnerability sits deep in the request processing pipeline, where configuration-level defenses cannot reach.

Recent security bulletins have also addressed other vulnerabilities in WebSphere Liberty, including SSRF (CVE-2026-1561) affecting Liberty 17.0.0.3 through 26.0.0.3 and privilege escalation (CVE-2025-14915) in Liberty.

References

• NVD: CVE-2026-8620
• IBM Security Bulletin: APAR PH71342
• IBM Fix Central: Interim Fix Downloads
• GitHub Advisory: GHSA-qwgm-xj6f-w5v6
• Positive Technologies dbugs: PT-2026-43363
• MITRE CWE-444: Inconsistent Interpretation of HTTP Requests
• IBM Security Bulletin: CVE-2015-3183 (Historical Precedent)
• OWASP: Testing for HTTP Request Smuggling
• PortSwigger: HTTP Request Smuggling
• IBM Security Bulletin: Related WebSphere Advisory
• Tenable CVE Database