back to all blogsSee all blog posts

Security vulnerabilities (CVEs) and notable bug fixes in 26.0.0.8

image of author
Ismath Badsha on Aug 11, 2026
announcements , release , security ,
Post available in languages: 简体中文 , 日本語 ,

This GA release addresses significant security vulnerabilities and includes important bug fixes that enhance stability and reliability.

In Open Liberty 26.0.0.8:

View the list of fixed bugs in 26.0.0.8.

Check out previous Open Liberty GA release blog posts.

Develop and run your apps using 26.0.0.8

If you’re using Maven, include the following in your pom.xml file:

<plugin>
    <groupId>io.openliberty.tools</groupId>
    <artifactId>liberty-maven-plugin</artifactId>
    <version>3.12.1</version>
</plugin>

Or for Gradle, include the following in your build.gradle file:

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'io.openliberty.tools:liberty-gradle-plugin:4.0.0'
    }
}
apply plugin: 'liberty'

Or if you’re using container images:

FROM icr.io/appcafe/open-liberty

Or take a look at our Downloads page.

If you’re using IntelliJ IDEA, Visual Studio Code or Eclipse IDE, you can also take advantage of our open source Liberty developer tools to enable effective development, testing, debugging and application management all from within your IDE.

Ask a question on Stack Overflow

Default parsing limits added to JSON Parsers

The JSON parsers that Liberty uses internally now enforce default limits on the size and structure of the JSON it parses. If an application processes JSON that exceeds a default limit, parsing stops and an exception is thrown.

To raise a limit, set the corresponding system property to a positive value, for example in the jvm.options file:

-Dorg.eclipse.parsson.maxParsingLimit=25000000

JSON4J

System property Default

com.ibm.json4j.max.array.size

100000

com.ibm.json4j.max.object.members

10000

com.ibm.json4j.max.nesting.depth

500

com.ibm.json4j.max.string.length

1048576

com.ibm.json4j.max.number.length

100

com.ibm.json4j.max.total.size

104857600 (100 MB)

Eclipse Parsson

System property Default

org.eclipse.parsson.maxBigIntegerScale

100000

org.eclipse.parsson.maxBigDecimalLength

1100

org.eclipse.parsson.maxDepth

1000

org.eclipse.parsson.maxParsingLimit

15000000 characters (roughly 10 MB of JSON)

Glassfish

System property Default

org.glassfish.json.maxBigIntegerScale

100000

org.glassfish.json.maxBigDecimalLength

1100

org.glassfish.json.maxDepth

1000

org.glassfish.json.maxParsingLimit

15000000 characters (roughly 10 MB of JSON)

Security vulnerability (CVE) fixes in this release

CVE CVSS Score Vulnerability Assessment Versions Affected Notes

CVE-2026-50645

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features

CVE-2026-9322

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features

CVE-2026-9171

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1, restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features

CVE-2026-9563

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the jsonp-2.1 feature

CVE-2026-10842

7.5

Bypass security

17.0.0.3-26.0.0.7

Affects the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, and appSecurity-4.0 features

CVE-2026-11897

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 features

CVE-2026-15057

7.5

Denial of service

17.0.0.3-26.0.0.7

Affects the servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 features

For a list of past security vulnerability fixes, reference the Security vulnerability (CVE) list.

Notable bugs fixed in this release

We’ve spent some time fixing bugs. The following sections describe the issues resolved in this release. If you’re interested, here’s the full list of bugs fixed in 26.0.0.8.

Get Open Liberty 26.0.0.8 now

Available through Maven, Gradle, Docker, and as a downloadable archive.