Denial of Service Vulnerability in Apache CXF Affecting Message Deserialization

CVE-2026-50645

What is CVE-2026-50645?

A vulnerability exists in Apache CXF that allows an attacker to exploit the deserialization process of messages, as there is no limit on the number of attachment headers a message can contain. This lack of restriction can lead to significant resource consumption, resulting in a denial of service condition. To mitigate this risk, it is highly recommended that users upgrade to versions 4.2.2 or 4.1.7, which introduce a cap of 500 attachments per message.

References