PUBLISHED
2026-06-12 10:16
MODIFIED
2026-06-12 10:16
EPSS (Prob. Exploit)
0.46%
Top 60.2%
> DESCRIPTION
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-400: Uncontrolled Resource Consumption - The product does not properly control the allocation and maintenance of a limited resource.
> GITHUB SECURITY ADVISORY
GHSA-ghvc-7hp8-2g2v
HIGH
Apache cxf-core: No restriction on attachment headers per message
AFFECTED PACKAGES:
MAVEN / org.apache.cxf:cxf-core
< 3.6.12
Fixed in: 3.6.12
MAVEN / org.apache.cxf:cxf-core
>= 4.0.0, < 4.1.7
Fixed in: 4.1.7
MAVEN / org.apache.cxf:cxf-core
>= 4.2.0, < 4.2.2
Fixed in: 4.2.2
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache CXF: No restriction on attachment headers per message
AFFECTED PACKAGES:
Unknown / Unknown
48 versions affected
ALIASES:
GHSA-ghvc-7hp8-2g2v
> HISTORIQUE DES MODIFICATIONS
Première apparition
12/06/2026 10:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-400: Uncontrolled Resource Consumption - The product does not properly control the allocation and maintenance of a limited resource.
Total des modifications: 1
Dernière mise à jour: 4 months ago