EUVD-2026-36403
GHSA-ghvc-7hp8-2g2v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed CXF endpoint
-
DeliveryCraft message with massive attachment header count
-
ExploitSend to deserialization endpoint
-
ExecutionExhaust JVM memory and CPU
-
ImpactService unavailable to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must expose an Apache CXF service endpoint (SOAP/JAX-WS or JAX-RS) that accepts multipart messages with attachments - typically any CXF deployment using MTOM or multipart/related content types in its default configuration on a vulnerable 4.2.0-4.2.1 or pre-4.1.7 build. No authentication, user interaction, or special privileges are required (PR:N/UI:N), and the attack is reachable over the network (AV:N). Exploitation is limited to availability impact only: services that strip multipart content at an upstream proxy, or that do not accept attachments at all, are not exposed even on vulnerable versions. |
| Impact | The signals are internally consistent but point to a moderate operational risk rather than an emergency. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High) confirms a network-reachable, unauthenticated, no-interaction DoS with no confidentiality or integrity impact, and SSVC corroborates this with Exploitation:none, Automatable:yes, Technical Impact:partial. EPSS is very low (0.02%, 5th percentile) and the CVE is not on CISA KEV, indicating no observed exploitation; however, because the attack is trivially automatable against any CXF endpoint accepting attachments, exposed gateways should still be patched promptly. No conflicting signals were identified across NVD, EUVD, and the oss-security advisory. |
| Exploit ScenarioDerived | A remote attacker sends a single crafted SOAP or MTOM message to a public Apache CXF endpoint containing an extremely large number of attachment headers; during deserialization the server allocates resources proportional to the header count, causing memory exhaustion or CPU saturation. Repeating the request from a small number of sources is sufficient to take the service offline. No public exploit identified at time of analysis, but the attack pattern is trivial to script and SSVC marks it as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 12, 2026
Denial of service in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 allows remote unauthenticated attackers to exhaust server resources by sending messages containing an unbounded number of attachment headers during deserialization. The flaw stems from missing input limits in the message deserialization path and can be triggered without authentication or user interaction. EPSS rates real-world exploitation probability as low (0.02%) and no public exploit identified at time of analysis, but SSVC flags the attack as automatable.
Earlier versions of this analysis (2)
Denial of service in Apache CXF affects versions prior to 4.2.2 and 4.1.7 because the MIME attachment deserializer imposed no upper bound on the number of attachment headers per message, letting remote unauthenticated attackers exhaust memory and CPU by sending a single crafted SOAP/MTOM message. CVSS 7.5 with SSVC marking the flaw automatable; EPSS is only 0.02% and no public exploit identified at time of analysis.
Uncontrolled resource consumption in Apache CXF's message deserialization layer allows attackers to exhaust server resources by sending messages with an unbounded number of attachment headers. Affected are org.apache.cxf:cxf-core versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7. The Apache CXF team rated this low severity; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the availability impact is real for any deployment exposing CXF endpoints that process MIME attachments.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch), both of which enforce a default maximum of 500 attachments per message; see the Apache CXF advisory at https://cxf.apache.org/ and the announcement at https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93. If immediate upgrade is not feasible, place CXF endpoints behind a reverse proxy or WAF that rejects multipart/MTOM messages exceeding a small attachment count or total size, and consider disabling attachment processing on services that do not require MTOM (trade-off: any legitimate clients sending attachments will break). Apply per-connection memory/CPU limits and aggressive request timeouts at the application server level to contain resource exhaustion until the patch is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and XML-based web services in Java applications, frequently embedded in enterprise middleware, ESBs, and SaaS backends. The vulnerability is a CWE-400 Uncontrolled Resource Consumption: the multipart/MTOM attachment deserializer accepted arbitrarily many attachment headers per inbound message with no upper bound, so each malicious message could allocate unbounded memory and CPU during header parsing. Fix versions 4.2.2 and 4.1.7 introduce a hard cap of 500 attachments per message as the new default, addressing the root cause at the parser layer.
Know when Cxf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated message to a default CXF endpoint with no user interaction; pure availability impact via resource exhaustion, no confidentiality or integrity effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5Description PRE-NVD
Blast Radius
ecosystem impact- 269 maven packages depend on org.apache.cxf:cxf-core (92 direct, 177 indirect)
Ecosystem-wide dependent count for version 4.2.0.
Articles & Coverage 1
Executive ViewAI
Apache CXF, used by organizations to deliver web services and APIs, contains a denial-of-service vulnerability in versions prior to 4.1.7 and 4.2.0 through 4.2.1 that allows unauthenticated remote attackers to disrupt service availability. No public exploit identified at time of analysis. Affected organizations should prioritize patching to protect business-critical service continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Exploit-DB