CVE-2026-64958 — Apache CXF: Denial of service via message header attachments

CVE-2026-64958

Apache CXF: Denial of service via message header attachments PUBLISHED

Description (CNA)

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache CXF	affected 4.2.0 before 4.2.3; affected 4.0.0 before 4.1.8; affected 0 before 3.6.12

CWE

CWE-400

References

https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.