CVE-2025-36047: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2025-36047 is a denial-of-service vulnerability in IBM WebSphere Application Server Liberty, part of the broader "MadeYouReset" class of HTTP/2 implementation flaws (tracked collectively as CVE-2025-8671). It affects IBM WebSphere Application Server Liberty versions 18.0.0.2 through 25.0.0.8, as well as downstream IBM products including IBM Application Performance Management and IBM Cloud Pak for Business Automation. A remote, unauthenticated attacker can send a specially-crafted HTTP/2 request to cause the server to consume excessive memory resources, resulting in denial of service. The vulnerability was published on August 14, 2025, with a CVSS v3.1 base score of 7.5 (High) (IBM Advisory, CERT/CC).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), stemming from a mismatch between HTTP/2 stream accounting and backend request processing in IBM WebSphere Application Server Liberty. When a client opens HTTP/2 streams and then triggers server-side stream resets (via malformed frames or flow control errors), the protocol marks those streams as closed while the server backend continues processing the associated requests. This allows an attacker to cause the server to handle an unbounded number of concurrent HTTP/2 requests on a single connection, exhausting memory resources. The vulnerability is part of the broader "MadeYouReset" attack class, similar in concept to CVE-2023-44487 ("Rapid Reset"), but exploiting server-triggered rather than client-triggered resets (CERT/CC, IBM Advisory).

Successful exploitation results in excessive memory consumption on the affected IBM WebSphere Application Server Liberty instance, leading to performance degradation, service unresponsiveness, or complete service interruption. The impact is limited to availability — there is no confidentiality or integrity impact. Downstream IBM products that embed WebSphere Application Server Liberty (such as IBM Application Performance Management and IBM Cloud Pak for Business Automation components) are also affected, potentially broadening the scope of disruption in enterprise environments (IBM Advisory, CERT/CC).

There is no public proof-of-concept exploit specifically targeting CVE-2025-36047, and no evidence of in-the-wild exploitation has been reported (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially accessible to any remote attacker with network access to the server. The EPSS score is approximately 0.113%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A GitHub repository named "MadeYouReset_Tester" has appeared, suggesting tooling for testing the broader vulnerability class exists (Feedly).

1. Reconnaissance: Identify internet-facing IBM WebSphere Application Server Liberty instances running versions 18.0.0.2 through 25.0.0.8 using network scanning tools (e.g., Shodan, Censys) or banner grabbing.
2. Establish HTTP/2 connection: Initiate an HTTP/2 connection to the target server, which supports HTTP/2 by default in Liberty.
3. Open multiple streams: Rapidly open a large number of HTTP/2 streams on the single connection, sending requests that will trigger server-side processing.
4. Trigger server-sent stream resets: Send malformed frames or induce flow control errors to cause the server to issue RST_STREAM frames, resetting streams from the server side.
5. Exploit accounting mismatch: Because reset streams are considered closed at the HTTP/2 protocol level but backend processing continues, repeat the open-and-reset cycle to cause the server to accumulate an unbounded number of concurrently processed requests.
6. Achieve denial of service: The server's memory is progressively exhausted as it processes an ever-growing backlog of requests, leading to degraded performance or a complete service outage (CERT/CC, IBM Advisory).

• Network: Unusually high volume of HTTP/2 RST_STREAM frames from a single client IP or small set of IPs; single connections with abnormally high stream counts; sustained inbound traffic to Liberty HTTP/2 endpoints without corresponding completed responses.
• Logs: Liberty access logs showing large numbers of requests initiated but not completed; repeated connection resets from the same source; error log entries related to memory allocation failures or resource exhaustion in the Liberty runtime.
• Process/System: Rapid growth in JVM heap usage on the Liberty server process; Java out-of-memory errors or garbage collection storms visible in JVM logs; server becoming unresponsive or restarting due to memory exhaustion.
• Monitoring Alerts: Alerts from APM tools indicating abnormal memory consumption trends on Liberty instances; sudden drops in request throughput correlated with memory spikes (CERT/CC).

IBM has released IBM WebSphere Application Server Liberty version 25.0.0.9 to address this vulnerability; organizations should upgrade immediately (IBM Advisory). For downstream products, IBM has issued separate advisories for IBM Application Performance Management and IBM Cloud Pak for Business Automation with corresponding iFixes (IBM APM Advisory, IBM CP4BA Advisory). As interim mitigations, organizations should implement network-level filtering to detect and block suspicious HTTP/2 traffic patterns, monitor server memory consumption with alerting thresholds, and consider restricting access to Liberty endpoints to trusted networks where feasible.

The broader "MadeYouReset" vulnerability class (CVE-2025-8671) received significant industry attention upon coordinated disclosure on August 13–14, 2025, with CERT/CC publishing a comprehensive vulnerability note covering multiple affected vendors (CERT/CC). SOCRadar published an explanatory blog post on the MadeYouReset HTTP/2 DoS technique, and Black Kite covered it in their Focus Friday TPRM series, highlighting it as a third-party risk concern for organizations using IBM WebSphere Liberty. The Open Liberty project (IBM's open-source Liberty runtime) published a blog post for the 25.0.0.9 release documenting the fix (Open Liberty Blog). The vulnerability was discovered and reported by researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University (CERT/CC).