CVE-2026-4410 describes a denial of service vulnerability in IBM WebSphere Application Server - Liberty and related versions. The issue arises from the server's handling of specially crafted requests that cause excessive memory consumption. This can lead to degraded performance or service unavailability. The vulnerability affects multiple versions including 19.0.0.7 through 26.0.0.5, and WebSphere Application Server versions 9.0 and 8.5. The CVSS 3.1 base score is 4.8, reflecting a medium severity with attack vector as adjacent network, high attack complexity, low privileges required, no user interaction, and impact limited to availability.

A remote attacker with adjacent network access and low privileges can trigger a denial of service by sending a specially crafted request that causes the server to consume excessive memory resources. This results in availability impact, potentially disrupting service for legitimate users. There is no impact on confidentiality or integrity reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM advisories for updates. Given the attack complexity and required access level, limiting network exposure and controlling access to the affected services may reduce risk.