IBM HTTP Server versions 8.5.0 and 9.0 contain a vulnerability identified as CVE-2026-8850, classified under CWE-476 (NULL Pointer Dereference). The issue resides in the optional module mod_ibm_upload and can be triggered remotely without authentication, resulting in a denial of service by crashing the server process. The CVSS v3.1 base score is 7.5, reflecting high severity due to the ease of exploitation and impact on availability. No vendor advisory or patch information is currently provided, and no exploits are known to be active in the wild.

Successful exploitation of this vulnerability causes a denial of service, making the IBM HTTP Server unavailable to legitimate users. There is no impact on confidentiality or integrity. The disruption affects availability only, potentially causing downtime and service interruptions for affected systems running the vulnerable versions with the mod_ibm_upload module enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the mod_ibm_upload module if it is not required to reduce exposure. Monitor IBM's security advisories for updates regarding patches or official mitigations.