CVE-2026-50645 — Apache CXF: No restriction on attachment headers per message

Description (CNA)

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache CXF	affected 4.2.0 before 4.2.2; affected 4.0.0 before 4.1.7; affected 0 before 3.6.12

CWE

CWE-400

References

https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/11/12

CISA-ADP

No English description supplied.

No references supplied.