GHSA-ghvc-7hp8-2g2v
Apache cxf-core: No restriction on attachment headers per message
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-50645
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.cxf:cxf-core | introduced 4.2.0, fixed 4.2.2 |
| Maven · org.apache.cxf:cxf-core | introduced 4.0.0, fixed 4.1.7 |
| Maven · org.apache.cxf:cxf-core | introduced 0, fixed 3.6.12 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-50645 ADVISORY
- https://cxf.apache.org/security-advisories.data/CVE-2026-50645.txt WEB
- https://github.com/apache/cxf PACKAGE
- https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93 WEB
- http://www.openwall.com/lists/oss-security/2026/06/11/12 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |