What is the CVSS score of EUVD-2026-53853?

EUVD-2026-53853 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-53853?

Yes, a patch is available for EUVD-2026-53853. Update the affected software to the latest version immediately.

Apache CXF EUVD-2026-53853

| CVE-2026-64958 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-06 apache

GHSA-3p6r-x275-5x98

Denial Of Service Apache Apache Cxf Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable endpoint, no authentication required for public services, single crafted request triggers exhaustion; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 06, 2026 - 12:01 EUVD

Analysis Generated

Aug 06, 2026 - 11:37 vuln.today

DescriptionCVE.org

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

AnalysisAI

Denial of service persists in Apache CXF due to an incomplete remediation of CVE-2026-50645, allowing unauthenticated network attackers to exhaust server resources by submitting messages containing an excessive number of MIME attachment headers. All Apache CXF deployments running versions prior to 4.2.3, 4.1.8, or 3.6.12 remain vulnerable despite having applied the prior patch. No public exploit code or active exploitation has been identified at time of analysis, but the bypass-of-fix nature of this vulnerability means any organization that patched CVE-2026-50645 and considered itself remediated must re-patch.

Technical ContextAI

Apache CXF (cpe:2.3:a:apache_software_foundation:apache_cxf:*:*:*:*:*:*:*:*) is a widely-used open-source Java web services framework supporting SOAP and RESTful services. The root cause class is CWE-400 (Uncontrolled Resource Consumption): when CXF parses inbound messages with MIME multipart attachments, it processes attachment headers without adequately bounding the number of headers it will iterate over. The prior fix for CVE-2026-50645 introduced an incomplete guard that can still be bypassed, allowing a specially crafted request to consume disproportionate CPU or memory. This is a classic resource exhaustion pattern in message-parsing libraries where header/part count limits are applied inconsistently across code paths.

RemediationAI

Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12 depending on the active branch, as confirmed by the Apache advisory at https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb. If an immediate upgrade is not feasible, compensating controls should focus on limiting inbound message size and header count at the reverse proxy or API gateway layer - for example, configuring nginx or Apache HTTP Server to reject requests with more than a defined number of headers (e.g., large_client_header_buffers or LimitRequestFields) before they reach CXF; this avoids exercising the vulnerable parser path but may reject legitimate multipart clients depending on their usage patterns. Rate-limiting inbound connections to CXF endpoints via a WAF or firewall can reduce the risk of sustained resource exhaustion, though it does not eliminate the underlying flaw. Note that simply re-applying or verifying the CVE-2026-50645 patch is insufficient - this CVE specifically documents bypass of that prior fix.