Denial of Service Vulnerability in Apache CXF by Apache
CVE-2026-64958

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Cxf
Vendor
CVE Published:
6 August 2026

What is CVE-2026-64958?

A previous fix for a denial of service vulnerability in Apache CXF was incomplete, allowing attackers to exploit the system by sending crafted messages containing numerous attachment headers. This vulnerability could lead to service disruption and requires urgent attention. Users are advised to upgrade to the fixed versions 4.2.3, 4.1.8, or 3.6.12 to mitigate associated risks.

Affected Version(s)

Apache CXF 4.2.0 < 4.2.3

Apache CXF 4.0.0 < 4.1.8

Apache CXF 0 < 3.6.12

References

https://lists.apache.org/thread/trsnkxc2f21585zlt819blvch...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Markus Vogl, RISE GmbH
.