Not rated
CVE-2026-76646 A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters,…
Description
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache MyFaces 4.1 | 4.1.0 → 4.1.3 | No fix stated |
| Apache MyFaces 4.0 | 4.0.0 → 4.0.3 | No fix stated |
| Apache MyFaces 3.0 | 3.0.0 → 3.0.3 | No fix stated |
| Apache MyFaces 2.3 | 2.3-next-M1 → 2.3.11 | No fix stated |
| Apache MyFaces 2.2 | 2.2.0-beta → 2.2.15 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified