CVE-2026-107937: Vulnerability in Apache Software Foundation Apache CXF

The vulnerability in Apache CXF arises because the parser for multipart/MTOM attachment part headers does not fully enforce the configured limits on attachment-max-header-size and attachment-headers-max-count. Specifically, the size limit applies only to each physical line, ignoring continuation lines and combined repeated header values, while the count limit checks only distinct header names rather than total header lines. This flaw allows a remote unauthenticated attacker to craft multipart requests with very large folded or repeated headers, causing the server to allocate memory without bound and leading to denial of service. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.

A remote unauthenticated attacker can exploit this vulnerability by sending specially crafted multipart requests that cause the server to allocate excessive memory, resulting in denial of service. There is no indication of code execution or data disclosure. The impact is limited to service availability disruption.

Users should upgrade Apache CXF to versions 4.2.4, 4.1.9, or 3.6.13 or later, which contain fixes for this vulnerability. No other mitigation is indicated or required according to the vendor advisory.