CVE-2026-9002

Name of the Vulnerable Software and Affected Versions IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6

Description Improper validation in the XDF decoder allows an adjacent attacker to cause a denial of service. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking. This can trigger a StackOverflowError or OutOfMemoryError, leading to a crash of the WebSphere Application Server JVM (Java Virtual Machine).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.