Which versions of Apache MyFaces are affected by CVE-2026-76646?

Apache MyFaces, the JSF framework embedded in a wide range of Java enterprise web applications and portals, is exposed to a critical unauthenticated remote denial-of-service condition affecting every…

How to fix or mitigate CVE-2026-76646?

Within 24 hours, inventory every application and service that bundles Apache MyFaces (including transitive dependencies in WAR/EAR artifacts and shared application-server libraries) and confirm the exact version in use against the affected ranges 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, and 4.1.0-4.1.3; notify the CISO and application owners, and as an immediate stopgap apply rate limiting and request-size/parameter-count restrictions at the WAF, reverse proxy, or load balancer for affected endpoints while logging anomalous request patterns. Within 7 days, upgrade all in-scope JSF applications to the vendor-fixed releases appropriate to their line - 2.3.12, 3.0.4, 4.0.4, or 4.1.4, or the 2.3-next-M9 development build where that branch is in use - and verify that the corrected MyFaces JAR is the one actually loaded at runtime, not merely present in the build file. Within 30 days, remediate the legacy 2.2.x line, which has no published fix in this advisory, by migrating those applications to a supported fixed release line, then validate the remediation with targeted load and malformed-parameter testing in pre-production, confirm monitoring and capacity alerting on affected services, and fold MyFaces version tracking into routine dependency-management reporting.

Apache MyFaces CVE-2026-76646

EUVD-2026-80956 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-09-16

GHSA-3h23-h733-q43f

Denial Of Service

Severity by source

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated request parsing before app auth (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Sep 16, 2026 - 17:05 vuln.today

CVE Published

Sep 16, 2026 - 15:35 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote, unauthenticated denial of service in Apache MyFaces allows any network-reachable attacker to exhaust server resources by submitting request parameters that the framework parses without bounds, degrading or halting the hosting JSF application. All supported release lines are affected in their earlier patch levels: 2.2.0 through 2.2.15, 2.3.0 through 2.3.11, 3.0.0 through 3.0.3, 4.0.0 through 4.0.3, 4.1.0 through 4.1.3, and the 2.3-next development branch, with older unsupported versions possibly affected as well. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a deployed Apache MyFaces application (Jakarta/JavaServer Faces) at an affected version (2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3, or 2.3-next-*) with any HTTP endpoint reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a remote denial-of-service in Apache MyFaces (a Jakarta/JavaServer Faces implementation) caused by unbounded parsing of attacker-supplied request parameters. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to a fixed MyFaces release: 2.3.12 on the 2.3 line, 2.3-next-M9 for the 2.3-next track, 3.0.4 on the 3.0 line, 4.0.4 on the 4.0 line, or 4.1.4 on the 4.1 line - these versions are explicitly called out by Apache as resolving the issue, as documented at https://lists.apache.org/thread/q8zxrdhbmmx8ofgr9s7ymnqo8l2x8oy9. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every application and service that bundles Apache MyFaces (including transitive dependencies in WAR/EAR artifacts and shared application-server libraries) and confirm the exact version in use against the affected ranges 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, and 4.1.0-4.1.3; notify the CISO and application owners, and as an immediate stopgap apply rate limiting and request-size/parameter-count restrictions at the WAF, reverse proxy, or load balancer for affected endpoints while logging anomalous request patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.