IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty versions 8.5 and 9.0 are vulnerable to HTTP request smuggling (CWE-444). This occurs when the Web Server Plug-ins inconsistently interpret HTTP requests, allowing an attacker to craft requests that can bypass security controls or interfere with request processing. The CVSS 3.1 base score is 7.5 (High), with network attack vector, high attack complexity, no privileges or user interaction required, and impacts confidentiality (high) and integrity (low) with no impact on availability. The vulnerability is published but no official remediation level or patch information is provided by IBM yet.

Successful exploitation of this vulnerability could allow an attacker to bypass security controls or manipulate HTTP request processing, leading to potential unauthorized access to sensitive information (high confidentiality impact) and limited modification of data (low integrity impact). Availability is not impacted. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM advisories closely. No vendor-provided mitigations or temporary fixes are currently documented.