CVE-2026-50645

Analyzed Analyzed - Analysis Complete

Apache CXF Denial of Service via Excessive Attachment Headers

Publication date: 2026-06-12

Last updated on: 2026-06-13

Assigner: Apache Software Foundation

Description

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-13

Generated

2026-07-02

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-50645

EUVD

EUVD-2026-36403

Affected Vendors & Products

Vendor	Product	Version / Range
apache	cxf	to 4.1.7 (exc)
apache	cxf	From 4.2.0 (inc) to 4.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache CXF occurs because there is no restriction on the number of attachment headers a message can contain during deserialization.

Without limits, an attacker can send messages with an excessive number of attachments, which can cause uncontrolled resource consumption or lead to a denial of service (DoS) attack.

The issue is fixed in Apache CXF versions 4.2.2 and 4.1.7 by imposing a default maximum limit of 500 attachments per message.

Impact Analysis

This vulnerability can impact you by allowing attackers to exhaust system resources through messages with a large number of attachments.

Such uncontrolled resource consumption can degrade system performance or cause a denial of service, making the affected service unavailable to legitimate users.

Mitigation Strategies

To mitigate this vulnerability, users are advised to upgrade Apache CXF to versions 4.2.2 or 4.1.7.

These versions fix the issue by imposing a maximum default limit of 500 attachments per message, preventing uncontrolled resource consumption or denial of service attacks.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-50645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70