CVE-2025-36047
📋 TL;DR
IBM WebSphere Application Server Liberty versions 18.0.0.2 through 25.0.0.8 are vulnerable to a denial of service attack where a remote attacker can send specially crafted requests to cause excessive memory consumption. This affects all deployments using vulnerable versions of the Liberty server, potentially leading to service disruption.
💻 Affected Systems
- IBM WebSphere Application Server Liberty
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to memory exhaustion, requiring server restart and causing extended downtime.
Likely Case
Degraded performance or temporary service interruption until memory is freed or server is restarted.
If Mitigated
Minimal impact with proper monitoring and rapid response to memory spikes.
🎯 Exploit Status
Exploitation requires crafting specific requests but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.0.0.9 and later
Vendor Advisory: https://www.ibm.com/support/pages/node/7242086
Restart Required: Yes
Instructions:
1. Download and install IBM WebSphere Application Server Liberty version 25.0.0.9 or later from IBM Fix Central. 2. Stop the Liberty server. 3. Apply the update. 4. Restart the Liberty server.
🔧 Temporary Workarounds
Rate Limiting
allImplement request rate limiting to prevent rapid exploitation attempts.
Configure via web server proxy (e.g., nginx rate_limit) or application firewall rules
Network Segmentation
allRestrict access to Liberty servers to trusted networks only.
Configure firewall rules to allow only necessary IP ranges
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy monitoring for abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Liberty server version using server.xml or command line: java -jar wlp/bin/productInfo versionCheck Version:
java -jar wlp/bin/productInfo versionVerify Fix Applied:
Verify version is 25.0.0.9 or later using same command and check for absence of memory spikes under normal load.📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption patterns in Liberty logs
- Multiple rapid requests from single sources
Network Indicators:
- Spike in incoming requests to Liberty endpoints
- Abnormal request patterns
SIEM Query:
source="liberty.log" AND ("memory" OR "heap") AND ("high" OR "exhausted")