CVE-2021-38951 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request

Matched remediation archetype

Resource exhaustion and denial of service

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Identify attacker-influenced work factors including input size, nesting, compression, fan-out, regex cost, allocation, recursion, retries, and connection lifetime.
• Map per-request and shared CPU, memory, disk, descriptor, thread, queue, and downstream-service limits.
• Determine whether authentication, tenancy, quotas, and rate controls apply before expensive processing begins.

Remediate safely

• Bound input size, nesting, expansion, work, concurrency, queue depth, retries, and execution time before resource-intensive processing.
• Release resources on every success, error, cancellation, and timeout path and use backpressure instead of unbounded buffering.
• Update affected components and add small deterministic tests that assert resource ceilings rather than exhausting a host.