CVE-2025-36099 IBM WebSphere Application Server denial of service
A privileged user can cause IBM WebSphere Application Server to consume memory resources via a specially-crafted request, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-36099?
CVE-2025-36099 is a medium-severity denial of service vulnerability in Ibm Websphere Application Server, published on 29 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources.
Weakness: CWE-770
Which versions are affected by CVE-2025-36099?
It affects 1 product.
Products include Ibm Websphere Application Server.
How do I fix CVE-2025-36099?
No fix has been published for CVE-2025-36099 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-36099 being exploited?
There is no known exploitation of CVE-2025-36099 in the wild and no public exploit code.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as GHSA-ggcf-3m97-33mp.