CVE-2026-50645: Apache CXF: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50645?
The severity of CVE-2026-50645 is classified as high with a CVSS score of 7.5.
What are the potential impacts of CVE-2026-50645?
CVE-2026-50645 can lead to uncontrolled resource consumption or a denial of service attack.
How do I fix CVE-2026-50645?
To fix CVE-2026-50645, users should upgrade to Apache CXF version 4.2.2 or 4.1.7.
Which software is affected by CVE-2026-50645?
CVE-2026-50645 affects Apache CXF.
What should I do if I cannot upgrade to a fixed version for CVE-2026-50645?
If upgrading is not possible, consider implementing strict message validation and monitoring for unusual resource consumption.