HIGHCVSS 7.5EPSS 0.5%

CVE-2026-50645

CVE-2026-50645 updated by NVD

Published: 2026-06-12
Modified: 2026-08-12
EPSS percentile: 38%
Sources: github-advisory, nvd

Summary

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.apache.cxf:cxf-core	—	4.2.2, 4.1.7, 3.6.12

Remediation: Upgrade to 4.2.2 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-50645

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.