Apache CXF CVE-2026-64958

The target must be running Apache CXF in any version prior to 4.2.3, 4.1.8, or 3.6.12, including versions that applied the patch for CVE-2026-50645. The endpoint must accept inbound SOAP or REST messages with MIME multipart/attachment content - this is a standard and common CXF deployment pattern (e.g., WS-Attachments, MTOM). No authentication is required if the endpoint is publicly accessible; authenticated endpoints limit exploitation to credential holders. The attack does not require a specific operating system, JVM version, or non-default configuration beyond multipart message handling being active, which is typical for CXF deployments. Limiting factor: if a reverse proxy or API gateway enforces strict header count limits upstream, the crafted request may be rejected before reaching CXF.

No CVSS vector or score has been published for this CVE at time of analysis, so all metric assessments below are independently derived. The vulnerability is network-reachable (web service endpoint), requires no authentication for publicly exposed services, and is low-complexity to trigger - a single crafted message is sufficient. The impact is purely availability (DoS), with no confidentiality or integrity implications. EPSS data is not available for this CVE. There is no CISA KEV listing and no public exploit code identified, lowering the immediate threat urgency. However, the bypass-of-fix nature is a meaningful risk amplifier: organizations that previously patched CVE-2026-50645 may have deprioritized this CVE under the false assumption that they are already protected. The real-world priority is elevated for any internet-facing CXF endpoint relative to its DoS-only CVSS impact.

An attacker sends a single HTTP POST request to any publicly accessible Apache CXF service endpoint, crafting the request body as a MIME multipart message with an abnormally large number of attachment headers. The CXF parser iterates over these headers in a way that the CVE-2026-50645 guard does not fully intercept, causing the server thread to consume excessive CPU or memory, degrading or halting service availability for legitimate clients. No authentication or prior access is required for externally exposed endpoints.