CVE-2025-36097: 
IBM WebSphere Application Server vulnerability analysis and mitigation

CVE-2025-36097 is a denial-of-service vulnerability in IBM WebSphere Application Server (WAS) and WebSphere Application Server Liberty caused by a stack-based buffer overflow (CWE-121). Affected versions include IBM WebSphere Application Server 9.0 (all builds prior to 9.0.5.24) and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7. The vulnerability was published on July 16, 2025, and patches were made available by August 2025. It carries a CVSS v3.1 base score of 7.5 (High) (IBM Advisory, Red Hat CVE).

The root cause is a stack-based buffer overflow (CWE-121) in the request-handling logic of IBM WebSphere Application Server and its Liberty variant. An unauthenticated remote attacker can send a specially crafted network request that triggers the overflow, causing the server to consume excessive memory resources. No authentication or user interaction is required, and the attack complexity is low, making it straightforward to trigger remotely over the network (IBM Advisory).

Successful exploitation results in a denial-of-service condition, causing the affected WebSphere Application Server or Liberty instance to consume excessive memory and potentially become unresponsive. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Organizations relying on WAS or Liberty for critical application hosting may experience service outages affecting end users and dependent systems (IBM Advisory, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-36097 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The vulnerability is detectable by Qualys (QIDs 383599, 383600, 385652) and Nessus (plugin 242285) (IBM Advisory, Tenable).

IBM has released patched versions to address this vulnerability: WebSphere Application Server 9.0 users should upgrade to fix pack 9.0.5.24 or later, and WebSphere Application Server Liberty users should upgrade to version 25.0.0.8 or later. The Open Liberty 25.0.0.8 release (August 12, 2025) also includes the fix. IBM Application Performance Management products that bundle WAS or Liberty are also affected and have a separate advisory. Organizations should apply the relevant fix pack as soon as possible and consult the IBM security bulletin for interim fixes if immediate upgrade is not feasible (IBM Advisory, IBM APM Advisory, Open Liberty Blog).

The vulnerability received routine coverage from vulnerability tracking services and security aggregators shortly after disclosure on July 16, 2025. CISA included it in its weekly vulnerability bulletin (SB25-202) for the week of July 14, 2025. RedPacket Security and other community aggregators shared alerts via social media. No notable independent researcher commentary or significant media coverage beyond standard advisory distribution has been identified (CISA Bulletin, RedPacket Security).