IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.12 (7295357)

high Nessus Plugin ID 380923

Synopsis

The remote web application server is affected by multiple vulnerabilities.

Description

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by multiple vulnerabilities as referenced in the 7295357 advisory.

- A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins (*), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control- Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality. (CVE-2026-89058)

- By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue. (CVE-2026-108039)

- In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.
The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue. (CVE-2026-107937)

- A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service. (CVE-2026-89059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update to IBM WebSphere Application Server Liberty version 26.0.0.12 or later.

Plugin Details

Severity: High

ID: 380923

File Name: websphere_liberty_7295357.nasl

Version: 1.1

Type: Remote

Agent: windows, macosx, unix

Family: Web Servers

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.57

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-89058

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:websphere_application_server

Required KB Items: installed_sw/IBM WebSphere Application Server

Exploit Ease: No known exploits are available

Patch Publication Date: 11/3/2026

Vulnerability Publication Date: 9/18/2026

Reference Information

CVE: CVE-2026-107937, CVE-2026-108039, CVE-2026-89058, CVE-2026-89059

Detections

Analytics