Remote Denial of Service Vulnerability in Apache Software
CVE-2026-76646

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Myfaces
Vendor
CVE Published:
16 September 2026

What is CVE-2026-76646?

A vulnerability exists in Apache Software where a remote attacker may exploit specially crafted request parameters that lead to excessive resource consumption. This exploitation could potentially result in a denial of service condition, disrupting the functionality of the affected software. Users are strongly advised to upgrade to the latest versions to mitigate this risk. Older, unsupported versions may also be susceptible.

Affected Version(s)

Apache MyFaces 2.2.0-beta <= 2.2.15

Apache MyFaces 2.3.0

Apache MyFaces 2.3-next-M1 <= 2.3-next-M8

References

https://lists.apache.org/thread/q8zxrdhbmmx8ofgr9s7ymnqo8...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k
.