Not rated
CVE-2026-50645 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache…
Description
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache CXF 4.2 | 4.2.0 → < 4.2.2 | 4.2.2 |
| Apache CXF 4.0 | 4.0.0 → < 4.1.7 | 4.1.7 |
| Apache CXF 3.6 | earliest → < 3.6.12 | 3.6.12 |
Other CVEs of Apache CXF
The 56 CVEs of Apache CXF →
CVE-2026-108039
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML…
Not rated
CVE-2026-107938
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the…
Not rated
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured…
Not rated
CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Not rated