EUVD-2026-36403
GHSA-ghvc-7hp8-2g2v
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated message to a default CXF endpoint with no user interaction; pure availability impact via resource exhaustion, no confidentiality or integrity effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Denial of service in Apache CXF versions 4.2.0 through 4.2.1 and all versions prior to 4.1.7 allows remote unauthenticated attackers to exhaust server resources by sending messages containing an unbounded number of attachment headers during deserialization. The flaw stems from missing input limits in the message deserialization path and can be triggered without authentication or user interaction. EPSS rates real-world exploitation probability as low (0.02%) and no public exploit identified at time of analysis, but SSVC flags the attack as automatable.
Technical ContextAI
Apache CXF is a widely deployed open-source services framework used to build SOAP, REST, and XML-based web services in Java applications, frequently embedded in enterprise middleware, ESBs, and SaaS backends. The vulnerability is a CWE-400 Uncontrolled Resource Consumption: the multipart/MTOM attachment deserializer accepted arbitrarily many attachment headers per inbound message with no upper bound, so each malicious message could allocate unbounded memory and CPU during header parsing. Fix versions 4.2.2 and 4.1.7 introduce a hard cap of 500 attachments per message as the new default, addressing the root cause at the parser layer.
RemediationAI
Vendor-released patch: upgrade to Apache CXF 4.2.2 (for the 4.2.x branch) or 4.1.7 (for the 4.1.x branch), both of which enforce a default maximum of 500 attachments per message; see the Apache CXF advisory at https://cxf.apache.org/ and the announcement at https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93. If immediate upgrade is not feasible, place CXF endpoints behind a reverse proxy or WAF that rejects multipart/MTOM messages exceeding a small attachment count or total size, and consider disabling attachment processing on services that do not require MTOM (trade-off: any legitimate clients sending attachments will break). Apply per-connection memory/CPU limits and aggressive request timeouts at the application server level to contain resource exhaustion until the patch is deployed.
A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attac
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote att
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending
Authentication bypass in Apache CXF's OAuthRequestFilter affects versions prior to 4.1.7 and 4.2.0-4.2.1, where an inver
XML External Entity (XXE) processing in Apache CXF versions prior to 4.1.7 and 4.2.0-4.2.1 allows remote attackers to tr
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn
Token confusion in Apache CXF's JwtAccessTokenValidator allows an attacker holding a valid JWT issued for one Resource S
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a cons
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryp
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today