CVE-2026-50645
Received Received - Intake
Apache CXF Denial of Service via Excessive Attachment Headers

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: Apache Software Foundation

Description
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-50645
EUVD
EUVD-2026-36403
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
apache cxf to 4.1.7 (inc)
apache cxf to 4.2.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Apache CXF occurs because there is no restriction on the number of attachment headers a message can contain during deserialization.

Without limits, an attacker can send messages with an excessive number of attachments, which can cause uncontrolled resource consumption or lead to a denial of service (DoS) attack.

The issue is fixed in Apache CXF versions 4.2.2 and 4.1.7 by imposing a default maximum limit of 500 attachments per message.

Impact Analysis

This vulnerability can impact you by allowing attackers to exhaust system resources through messages with a large number of attachments.

Such uncontrolled resource consumption can degrade system performance or cause a denial of service, making the affected service unavailable to legitimate users.

Mitigation Strategies

To mitigate this vulnerability, users are advised to upgrade Apache CXF to versions 4.2.2 or 4.1.7.

These versions fix the issue by imposing a maximum default limit of 500 attachments per message, preventing uncontrolled resource consumption or denial of service attacks.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart