CVE list update for 26.0.0.8

[clarkek123]

This issue is opened to update the OL CVE list for 26.0.0.8. @ayoho fyi.

|https://www.cve.org/CVERecord?id=CVE-2026-50645[CVE-2026-50645]

|7.5

|Denial of service

|17.0.0.3-26.0.0.7

|26.0.0.8

|Affects the feature:jaxrs-2.1 feature:restfulWS-3.0 feature:restfulWS-3.1 feature:restfulWS-4.0 feature:json1.0 feature:jsonp-1.0 feature jsonp-1.1 feature:jsonp-2.0 feature:jsonp-2.1 feature:jaxws-2.2 feature:xmlWS-3.0 feature:xmlWS-4.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-9322[CVE-2026-9322]

|7.5

|Denial of service

|17.0.0.3-26.0.0.7

|26.0.0.8

|Affects the feature:jaxrs-2.1 feature:restfulWS-3.0 feature:restfulWS-3.1 feature:restfulWS-4.0 feature:json1.0 feature:jsonp-1.0 feature jsonp-1.1 feature:jsonp-2.0 feature:jsonp-2.1 feature:jaxws-2.2 feature:xmlWS-3.0 feature:xmlWS-4.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-9171[CVE-2026-9171]

|7.5

|Denial of service

|17.0.0.3-26.0.0.7

|26.0.0.8

|Affects the feature:jaxrs-2.1 feature:restfulWS-3.0 feature:restfulWS-3.1 feature:restfulWS-4.0 feature:json1.0 feature:jsonp-1.0 feature jsonp-1.1 feature:jsonp-2.0 feature:jsonp-2.1 feature:jaxws-2.2 feature:xmlWS-3.0 feature:xmlWS-4.0 features

|https://www.cve.org/CVERecord?id=CVE-2026-9563[CVE-2026-9563]

|7.5

|Denial of service

|17.0.0.3-26.0.0.7

|26.0.0.8

|Affects the feature:jsonp-2.1 feature

|https://www.cve.org/CVERecord?id=CVE-2026-10842[CVE-2026-10842]

|7.5

|Bypass security

|17.0.0.3-26.0.0.7

|26.0.0.8
|
Affects the feature:appSecurity-1.0 feature:appSecurity-2.0 feature:appSecurity-3.0 feature:appSecurity-4.0 feature

|https://www.cve.org/CVERecord?id=CVE-2026-11897[CVE-2026-11897]

|7.5

|Denial of service
|
17.0.0.3-26.0.0.7

|26.0.0.8
|Affects the feature:servlet-3.1 feature:servlet-4.0 feature:servlet-5.0 feature:servlet-6.0 or feature:servlet-6.1 features

|https://www.cve.org/CVERecord?id=CVE-2026-15057[CVE-2026-15057]

|7.5

|Denial of service
|
17.0.0.3-26.0.0.7
|
26.0.0.8

|Affects the feature:servlet-3.1 feature:servlet-4.0 feature:servlet-5.0 feature:servlet-6.0 or feature:servlet-6.1 features

[ramkumar-k-9286]

hi @clarkek123

Suggested review comments have been incorporated to the Security vulnerability (CVE) list page.

Draft site Link: https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/security-vulnerabilities.html

Please review the same and add Developer Reviewed label if you are satisfied with the changes.

Regards,
Ramkumar.

[clarkek123]

@ramkumar-k-9286 There seems to be an issue in the draft version where the jsonp-1.1 feature link is not resolving. I see that jsonp-1.1 is shown to be in open liberty at this feature list so I don't understand why it is not resolving - https://www.ibm.com/docs/en/was-liberty/base?topic=management-liberty-features

It looks like jsonp-1.1 should have resolved and linked to this article - https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/reference/feature/jsonp-1.1.html.

Is there something in the docs repo that enables the automatic link. I don't see anything in the original input "feature jsonp-1.1" that is wrong.

[clarkek123]

@ramkumar-k-9286 some other issues are that

1. json-1.0 is not resolving when I click on the link. I think that the draft will need to be updated with json-1.0 vs json10 throughout. The dash was missing in what I provided.

There are some changes out of our control for the CVE descriptions for the following CVEs which have not reached Mitre and therefore the links do not resolve. I have reached out to PSIRT Ops in the #psirt-community slack thread to get these resolved. They are the Mitre links for CVE-2026-9322, CVE-2026-9171, CVE-2026-10842.

[clarkek123]

@ramkumar-k-9286 I will be OOO next week so am looping @ayoho in on this as well. I will be checking in tomorrow if you have updates then.

[clarkek123]

@ramkumar-k-9286 I have worked with PSIRT OPs to have the CVEs updated in Mitre so the CVE links are good now. I checked all other links in the docs and the two issues that I'll need your help to update in draft are:

1. jsonp-1.1 feature link is not resolving (see comment above)
2. json1.0 needs a dash (eg. json-1.0) so that link will resolve to a feature.

[ramkumar-k-9286]

Hi @clarkek123

Suggested corrections have been incorporated to the Security vulnerability (CVE) list page.

Draft site Link: https://docs-draft-openlibertyio.mqj6zf7jocq.us-south.codeengine.appdomain.cloud/docs/latest/security-vulnerabilities.html

Please review the same and add Developer Reviewed label if you are satisfied with the changes.

Regards,
Ramkumar.

[clarkek123]

@ramkumar-k-9286 Thank you! I have re-reviewed for json-1.0 and jsonp-1.1 and those look good now. I've added the Developer reviewed.