CVE-2026-8854

A stack-based buffer overflow exists in the Administration Server of IBM HTTP Server affecting versions 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7. This allows remote authenticated users to execute arbitrary code.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service and potential remote code execution due to improper input validation.

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

IBM HTTP Server 8.5 and 9.0 is vulnerable to invalid pointer dereference. A privileged user authenticated to the Administration Server could exploit this to expose sensitive information or cause a denial of service.

IBM HTTP Server 8.5 and 9.0 contain a buffer overflow vulnerability. A privileged user authenticated to the Administration Server could exploit this to execute remote code or cause a denial of service.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service via the optional mod_fastcgi module.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service via the optional module mod_ibm_upload.