Apache CXF CVE-2026-107937

The target must expose an Apache CXF endpoint that accepts multipart/MTOM attachment requests (SOAP/JAX-WS or JAX-RS services with MTOM attachment processing reachable by the attacker). Exploitation specifically abuses the attachment part-header parser: an attacker supplies part headers as many folded continuation lines or as a repeated header name so the combined value exceeds attachment-max-header-size (default 300) and attachment-headers-max-count (default 500), which the parser fails to enforce across continuation/repeated headers. No special non-default configuration is required and no authentication or user interaction is needed (PR:N/UI:N), so default MTOM-enabled deployments on affected versions (CXF 4.2.0-4.2.3, 4.0.0/4.1.x <4.1.9, <3.6.13) are vulnerable. The main limiting factor is reachability: only services that actually accept and parse multipart/MTOM attachments are exposed, and impact is confined to availability (service crash/unresponsiveness), not data compromise.

This is a genuine but moderate-priority availability issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: a remote, unauthenticated attacker can trigger the flaw over the network with low complexity and no user interaction, and the sole impact is availability (CWE-770, uncontrolled resource allocation / memory exhaustion DoS) with no confidentiality or integrity impact. Multi-source signals argue against treating this as a drop-everything emergency: EPSS is only 0.24% (14th percentile), the vulnerability is NOT on the CISA KEV list, and no public PoC is referenced in the provided intelligence. The signals are therefore aligned and low - low exploitation probability, no confirmed in-the-wild activity, no known exploit code - which is typical for a memory-exhaustion DoS that yields no code execution or data access. The high CVSS is driven entirely by the A:H availability impact and easy network reachability, not by any systemic compromise potential. Net: patch on a normal maintenance cycle, prioritizing internet-facing CXF endpoints that accept multipart/MTOM; this is a real but bounded DoS rather than a high-real-risk breach vector.

An attacker sends a crafted multipart/MTOM request to a public Apache CXF web-service endpoint, embedding attachment part headers that use many folded continuation lines or a repeated header name so the combined value vastly exceeds the intended 300-character / 500-count limits. Because the parser enforces limits only per physical line and per distinct header name, the server allocates memory without bound while assembling these headers, exhausting heap and causing a denial of service. No authentication or user interaction is required; no public exploit code is identified at time of analysis.