CVE-2023-32342: IBM HTTP Server

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828.

Affected products

• IBM HTTP Server: from 8.5.0.0, before 8.5.5.24 (fixed in 8.5.5.24); from 9.0.0.0, before 9.0.5.16 (fixed in 9.0.5.16)

Published 2023-05-30. Last modified 2026-06-17.