CVE-2026-107937

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-09

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107937

EUVD

EUVD-2026-95702

Affected Vendors & Products

Vendor	Product	Version / Range
apache	cxf	to 3.6.13 (exc)
apache	cxf	From 4.0.0 (inc) to 4.1.9 (exc)
apache	cxf	From 4.2.0 (inc) to 4.2.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache CXF involves improper enforcement of attachment header size and count limits. The parser did not correctly apply the attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. Attackers could exploit this by sending multipart requests with excessively large or repeated headers, causing unbounded memory allocation and a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring Apache CXF servers for unusually large or repeated multipart headers. Check server logs for requests exceeding default header size or count limits. Use network monitoring tools to inspect incoming multipart requests for header anomalies.

Impact Analysis

If you use Apache CXF, an attacker could exploit this to crash your server by sending specially crafted requests. This could disrupt services, cause downtime, and potentially lead to data unavailability. Upgrading to fixed versions (4.2.4, 4.1.9, or 3.6.13) is recommended to mitigate the risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. Unbounded memory allocation due to maliciously crafted multipart headers may lead to system instability or crashes, which could interfere with data processing or access required for compliance.

Mitigation Strategies

Immediately upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13. If upgrading is not possible, apply strict input validation to block oversized or malformed multipart headers. Monitor server memory usage and network traffic for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-107937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70