CVE-2026-64958

Published: Aug 6, 2026Modified: Aug 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected (3)

Products: Apache: Cxf

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.6.12
Apache Cxf	From 4.0.0 to 4.1.8
Apache Cxf	From 4.2.0 to 4.2.3

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (1)

https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb

Source: security@apache.org

Mailing ListVendor Advisory

Timeline

No history available yet.