Threat Intelligence Database

CVE-2026-64958 is a denial of service vulnerability in Apache CXF caused by an incomplete fix for a previous issue (CVE-2026-50645). The flaw allows attackers to exhaust resources by sending messages with many attachment headers. The issue is resolved in Apache CXF versions 4.2.3, 4.1.8, and 3.6.12.

Apache CXF versions prior to 4.2.3, 4.1.8, and 3.6.12 do not impose a default limit on the maximum attachment size, which can lead to denial of service (DoS) attacks if users do not explicitly configure this limit. The issue is addressed by setting a default attachment size limit of 50MB in the fixed versions.

Apache CXF versions prior to 4.1.7, 4.2.2, and 3.6.12 allow an unlimited number of attachment headers during message deserialization. This lack of restriction can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions. The issue is addressed by imposing a default maximum of 500 attachments per message in the fixed versions.

CVE-2026-49875 is an information disclosure vulnerability in Apache CXF caused by improper XML parser configuration that allows out-of-band external entity resolution. This flaw affects the EndpointReferenceUtils and W3CMultiSchemaFactory classes, enabling remote attackers to disclose sensitive information without user interaction. The vulnerability is addressed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. Red Hat products bundling Apache CXF are also affected, but currently no effective mitigation or fix meeting Red Hat's criteria is available for those products.