CVE-2026-15064 is an HTTP Response Smuggling vulnerability in IBM WebSphere Application Server (WAS) Liberty, affecting versions 17.0.0.3 through 26.0.7. The vulnerability stems from ambiguous parsing of non-standard HTTP version tokens at the earliest stage of the HTTP processing pipeline — before many security controls, middleware chains, or WAFs typically inspect traffic. This positioning is what makes the finding analytically significant: an attacker exploiting version token ambiguity is effectively smuggling past the initial parsing gate itself, bypassing controls that would catch conventional request smuggling attempts.
The contiguous version range spanning nine major Liberty releases is telling. This isn't scattered affected versions across a release train — it's a solid block suggesting the vulnerable code path lives in a shared parsing module that wasn't updated as the product evolved. That pattern usually indicates legacy protocol handling that persisted through refactoring cycles without scrutiny.
Response smuggling differs fundamentally from the more common request smuggling: the attacker exploits how a frontend proxy and backend server interpret the same response stream differently, enabling injection of malicious content into legitimate user sessions. In IBM's typical deployment topology — where WAS sits behind IBM HTTP Server (IHS) and often fronts DB2, MQ, or other backend systems — a successful response poison can propagate through connection pools to backends that implicitly trust the WAS layer.
For defenders, the immediate priority is confirming whether your WAS deployment sits behind any reverse proxy. If it does, understand how that proxy handles ambiguous HTTP version tokens and whether the two systems could diverge on parsing. The EPSS score of 0.0022 is low, which likely reflects that response smuggling is harder to weaponize than request smuggling in practice — but the CVSS 8.7 reflects the genuine impact if exploitation succeeds.
The critical unresolved question is whether the patch rejects non-standard tokens outright or attempts to normalize them. If IBM normalized ambiguous tokens rather than rejecting them, that normalization logic becomes a new attack surface for version-confusion variants. Review the actual fix in the latest Liberty patch to determine which approach was taken, and treat any normalization behavior as a potential future vulnerability vector. The version parsing code at the HTTP pipeline chokepoint is exactly the kind of low-visibility, high-leverage path that attackers target — and where defenders have the least tooling coverage.