PT-2026-48854 · Apache · Apache Cxf

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-50645

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.1.7 Apache CXF versions prior to 4.2.2

Description Apache CXF lacks restrictions on the number of attachment headers a message can contain during deserialization. This can lead to uncontrolled resource consumption, potentially resulting in a denial of service attack.

Recommendations Upgrade to version 4.1.7. Upgrade to version 4.2.2.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-50645

Affected Products

Apache Cxf

References · 4

• https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50645 · Security Note
• https://twitter.com/VulmonFeeds/status/2065394061788254673 · Twitter Post
• http://openwall.com/lists/oss-security/2026/06/11/12 · Note