Resource exhaustion in Apache CXF - CVE-2026-50645

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136712

Resource exhaustion in Apache CXF - CVE-2026-50645

Published: July 2, 2026


Vulnerability identifier: #VU136712
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-50645
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to there is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache CXF
IBM WebSphere Application Server Liberty
IBM WebSphere Application Server
PowerVM NovaLink
Tivoli Network Manager IP Edition
Enterprise Application Runtimes
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM SPSS Collaboration and Deployment Services
WebSphere Remote Server
WebSphere Service Registry and Repository
IBM Rational ClearQuest
IBM License Metric Tool
IBM Watson Explorer Foundational Components
IBM Watson Explorer Analytical Components

How to mitigate CVE-2026-50645

Install updates from vendor's website.

Apache CXF - addressed in versions 4.1.7, 4.2.2
IBM WebSphere Application Server Liberty - update to 26.0.0.8
PowerVM NovaLink - addressed in versions 2.2.1.1-260708, 2.3.3-260714
IBM WebSphere Application Server - addressed in versions 8.5.5.31, 9.0.5.29
IBM Watson Explorer Foundational Components - update to 12.0.3.22 PH71585
IBM Watson Explorer Analytical Components - update to 12.0.3.22 PH71585

External References

Related Security Bulletins