Resource exhaustion in Apache CXF - CVE-2026-50645

Vulnerability identifier: #VU136712

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-50645

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to there is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Apache CXF
IBM WebSphere Application Server Liberty
IBM WebSphere Application Server
Voice Gateway
Jazz for Service Management
IBM SPSS Analytic Server
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli System Automation Application Manager
IBM Tivoli Monitoring
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM MQ
IBM Rational ClearQuest
IBM Business Automation Workflow
PowerVM NovaLink
Tivoli Network Manager IP Edition
Enterprise Application Runtimes
Cloud Pak for Applications
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Maximo Application Suite - Monitor Component
IBM MQ Appliance
IBM License Metric Tool
IBM Watson Explorer Analytical Components
IBM Watson Explorer Foundational Components

Install updates from vendor's website.

Apache CXF - addressed in versions 4.1.7, 4.2.2
IBM WebSphere Application Server Liberty - update to 26.0.0.8
Voice Gateway - addressed in versions 1.0.8.21, 1.0.8.29
PowerVM NovaLink - addressed in versions 2.2.1.1-260708, 2.3.3-260714
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29
Maximo Application Suite - Monitor Component - addressed in versions 9.0.25, 9.1.15, 9.2.4
IBM MQ - addressed in versions 9.1.0.38, 9.2.0.44, 9.3.0.42, 9.4.0.26, 10.0.0.5
IBM MQ Appliance - addressed in versions 9.4.0.26, 9.4.5.3, 10.0.0.5
IBM Watson Explorer Analytical Components - update to 12.0.3.22 PH71585
IBM Watson Explorer Foundational Components - update to 12.0.3.22 PH71585

• https://lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93
• http://www.openwall.com/lists/oss-security/2026/06/11/12
• https://lists.apache.org/thread/jyw8opqthpb419vvq9bgp1ccfm0771dc

• Multiple vulnerabilities in Apache CXF
• Multiple vulnerabilities in IBM WebSphere Application Server and WebSphere Application Server Liberty
• Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager (GKLM)
• Multiple vulnerabilities in IBM Enterprise Application Runtimes
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Multiple vulnerabilities in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Watson Explorer
• Multiple vulnerabilities in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM License Metric Tool
• Multiple vulnerabilities in IBM Tivoli System Automation Application Manager
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Jazz for Service Management
• Multiple vulnerabilities in IBM Tivoli Composite Application Manager for Application Diagnostics
• Multiple vulnerabilities in IBM Cloud Pak for Applications
• Multiple vulnerabilities in IBM Businsess Automation Workflow
• Multiple vulnerabilities in IBM SPSS Analytic Server
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in IBM MQ Appliance
• Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager (ITNCM)
• Multiple vulnerabilities in IBM MQ
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component