Security vulnerabilities (CVEs) and notable bug fixes in 26.0.0.8

Ismath Badsha on Aug 11, 2026

announcements , release , security ,

Post available in languages:

This GA release addresses significant security vulnerabilities and includes important bug fixes that enhance stability and reliability.

In Open Liberty 26.0.0.8:

Security Vulnerability (CVE) Fixes
Notable bug fixes

View the list of fixed bugs in 26.0.0.8.

Check out previous Open Liberty GA release blog posts.

Develop and run your apps using 26.0.0.8

If you’re using Maven, include the following in your pom.xml file:

<plugin>
    <groupId>io.openliberty.tools</groupId>
    <artifactId>liberty-maven-plugin</artifactId>
    <version>3.12.1</version>
</plugin>

Or for Gradle, include the following in your build.gradle file:

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'io.openliberty.tools:liberty-gradle-plugin:4.0.0'
    }
}
apply plugin: 'liberty'

Or if you’re using container images:

FROM icr.io/appcafe/open-liberty

Or take a look at our Downloads page.

If you’re using IntelliJ IDEA, Visual Studio Code or Eclipse IDE, you can also take advantage of our open source Liberty developer tools to enable effective development, testing, debugging and application management all from within your IDE.

Security vulnerability (CVE) fixes in this release

CVE	CVSS Score	Vulnerability Assessment	Versions Affected	Notes
CVE-2026-50645	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `jaxrs-2.1`, `restfulWS-3.0`, `restfulWS-3.1`, `restfulWS-4.0`, `json-1.0`, `jsonp-1.0`, `jsonp-1.1`, `jsonp-2.0`, `jsonp-2.1`, `jaxws-2.2`, `xmlWS-3.0`, and `xmlWS-4.0` features
CVE-2026-9322	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `jaxrs-2.1`, `restfulWS-3.0`, `restfulWS-3.1`, `restfulWS-4.0`, `json-1.0`, `jsonp-1.0`, `jsonp-1.1`, `jsonp-2.0`, `jsonp-2.1`, `jaxws-2.2`, `xmlWS-3.0`, and `xmlWS-4.0` features
CVE-2026-9171	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `jaxrs-2.1`, `restfulWS-3.0`, `restfulWS-3.1`, `restfulWS-4.0`, `json-1.0`, `jsonp-1.0`, `jsonp-1.1`, `jsonp-2.0`, `jsonp-2.1`, `jaxws-2.2`, `xmlWS-3.0`, and `xmlWS-4.0` features
CVE-2026-9563	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `jsonp-2.1` feature
CVE-2026-10842	7.5	Bypass security	17.0.0.3-26.0.0.7	Affects the `appSecurity-1.0`, `appSecurity-2.0`, `appSecurity-3.0`, and `appSecurity-4.0` features
CVE-2026-11897	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `servlet-3.1`, `servlet-4.0`, `servlet-5.0`, `servlet-6.0`, or `servlet-6.1` features
CVE-2026-15057	7.5	Denial of service	17.0.0.3-26.0.0.7	Affects the `servlet-3.1`, `servlet-4.0`, `servlet-5.0`, `servlet-6.0`, or `servlet-6.1` features

For a list of past security vulnerability fixes, reference the Security vulnerability (CVE) list.

Notable bugs fixed in this release

We’ve spent some time fixing bugs. The following sections describe the issues resolved in this release. If you’re interested, here’s the full list of bugs fixed in 26.0.0.8.

Get Open Liberty 26.0.0.8 now

Available through Maven, Gradle, Docker, and as a downloadable archive.

See all blog posts