Denial of Service Vulnerability in Apache CXF by Apache
CVE-2026-64958

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Cxf
Vendor
CVE Published:
6 August 2026

What is CVE-2026-64958?

A previous fix for a denial of service vulnerability in Apache CXF was incomplete, allowing attackers to exploit the system by sending crafted messages containing numerous attachment headers. This vulnerability could lead to service disruption and requires urgent attention. Users are advised to upgrade to the fixed versions 4.2.3, 4.1.8, or 3.6.12 to mitigate associated risks.

Affected Version(s)

Apache CXF 4.2.0 < 4.2.3

Apache CXF 4.0.0 < 4.1.8

Apache CXF 0 < 3.6.12

References

https://lists.apache.org/thread/trsnkxc2f21585zlt819blvch...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Markus Vogl, RISE GmbH
.