CVE-2026-9071 is a denial of service vulnerability (CWE-400) in IBM WebSphere Application Server 9.0.0, 8.5.0, and Liberty 17.0.0.3 through 26.0.0.6. The issue arises from the server's failure to properly control resource consumption when processing certain crafted requests, enabling a remote attacker to exhaust memory resources and disrupt service availability. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation results in denial of service by causing the server to consume excessive memory resources, potentially leading to server unavailability or crashes. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider limiting exposure of affected versions to untrusted networks and monitor for unusual memory consumption patterns.