7.5Alta
CVE-2026-50645Apache CXF: No restriction on attachment headers per message
Descripción
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Debilidad (CWE):
CWE-400
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 – < 4.2.2, 4.0.0 – < 4.1.7, < 3.6.12 | |
| apache | cxf | < 3.6.12 |
Referencias y parches
- https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93 vendor-advisoryVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/11/12 Mailing ListThird Party Advisory
Coincidencias CPE (NVD) (3)
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*< 3.6.12cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.1.7cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.2