Description

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T11:16:30.350Z",
  "pubdate": "2026-08-06T11:16:30.350Z",
  "executiveSummary": "An incomplete fix for CVE-2026-50645 in Apache CXF leaves the software vulnerable to a denial of service attack. The vulnerability stems from improper handling of messages containing an excessive number of attachment headers, which can exhaust system resources and render the service unavailable.\nThe affected product is Apache CXF, and the security risk involves service disruption and resource exhaustion. Attackers with network access can exploit this vulnerability by transmitting specially crafted payloads designed to trigger excessive resource consumption during parsing.\nSuccessful exploitation requires no prior authentication or elevated privileges, lowering the barrier for potential threat actors. Because the initial remediation attempt was insufficient, systems running vulnerable versions remain exposed to availability degradation or complete application crashes.\nTo eliminate the risk, administrators must update the affected Apache CXF deployments to the specified secure versions provided by the vendor.",
  "technicalDetails": "The vulnerability resides within the message processing component of Apache CXF, specifically in how attachment headers are parsed and handled. Due to an incomplete fix for CVE-2026-50645, the underlying parser fails to adequately bound or limit the processing of excessively large quantities of attachment headers within incoming messages.\nExploitation occurs over the network without requiring authentication or specific user privileges. An attacker initiates the attack flow by constructing and transmitting an HTTP or SOAP message containing an abnormally high number of attachment headers to the target Apache CXF endpoint.\nUpon receiving the malicious payload, the vulnerable component attempts to parse and iterate through all provided attachment headers. Because there is a lack of strict threshold enforcement or rate limiting on these headers, the parsing mechanism consumes disproportionate CPU and memory resources.\nThis uncontrolled resource consumption leads to thread exhaustion, severe performance degradation, or an unhandled out-of-memory exception, culminating in a denial of service condition that disrupts legitimate traffic and service availability."
}