IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty versions 8.5 and 9.0 are vulnerable to HTTP request smuggling (CWE-444). This vulnerability arises from inconsistent parsing of HTTP requests by the plug-ins, allowing an attacker to craft requests that can be interpreted differently by front-end and back-end servers. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with high complexity, no privileges or user interaction required, and a scope change. The impact includes high confidentiality loss and limited integrity compromise. No patch or official remediation level has been published as of the data provided.

Successful exploitation could allow an attacker to bypass security controls, potentially leading to unauthorized access to sensitive information (high confidentiality impact) and limited modification of data (low integrity impact). There is no impact on system availability. The vulnerability could affect the trustworthiness of HTTP request handling in affected IBM Web Server Plug-ins, potentially enabling advanced evasion techniques or unauthorized request manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor IBM advisories for updates. Until a patch is available, consider applying any recommended configuration changes from IBM to mitigate HTTP request smuggling risks if provided. Avoid exposure of vulnerable plug-ins to untrusted networks where possible.