STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

Maximum in-memory session count must be set according to application requirements.

DISA Rule

SV-250322r960735_rule

Vulnerability Number

V-250322

Group Title

SRG-APP-000001-AS-000001

Rule Version

IBMW-LS-000010

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

To limit the max number of concurrent sessions available, the ${server.config.dir}/server.xml must be configured with maxInMemorySessionCount set according to system security plan and allowOverflow="false".

EXAMPLE:
<httpSession maxInMemorySessionCount="5" allowOverflow="false" />

Check Contents

Review the System Security plan to determine the maximum number of concurrent sessions allowed. This is a per user setting and must be defined by the application admins.

As a privileged user with access to the server.xml file, review file content and identify the "maxInMemorySessionCount" and the allowOverflow settings.

EXAMPLE:
grep -i maxInMemorySessionCount server.xml

<httpSession maxInMemorySessionCount="xxxx" allowOverflow="false" />

If maxInMemorySessionCount is not set in server.xml according to the settings defined in the system security plan or if allowOverflow="true", this is a finding.

Vulnerability Number

V-250322

Documentable

False

Rule Version

IBMW-LS-000010

Severity Override Guidance

Review the System Security plan to determine the maximum number of concurrent sessions allowed. This is a per user setting and must be defined by the application admins.

As a privileged user with access to the server.xml file, review file content and identify the "maxInMemorySessionCount" and the allowOverflow settings.

EXAMPLE:
grep -i maxInMemorySessionCount server.xml

<httpSession maxInMemorySessionCount="xxxx" allowOverflow="false" />

If maxInMemorySessionCount is not set in server.xml according to the settings defined in the system security plan or if allowOverflow="true", this is a finding.

Check Content Reference

M

Target Key

5424