CVE-2026-50645
Apache CXF: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
CVE-2026-50645- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-05
CVE List
Apache CXF: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
CVE-2026-50645- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-36403
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
EUVD-2026-36403- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ghvc-7hp8-2g2v
Apache cxf-core: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
GHSA-ghvc-7hp8-2g2v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Apache CXF: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
CVE-2026-50645- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-07
OSVGHSA-ghvc-7hp8-2g2v
Apache cxf-core: No restriction on attachment headers per message
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.
- Record
GHSA-ghvc-7hp8-2g2v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1788474736 No score
TuxCare security update for org.apache.cxf (5 CVEs)
TuxCare rebuilt 4 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.9.
- Record
CLSA-2026-1788474736- Updated
- 2026-11-02
OSVCLSA-2026-1790900201 No score
TuxCare security update for org.apache.cxf:cxf-core (1 CVE)
TuxCare rebuilt org.apache.cxf:cxf-core to address 1 CVE. Fixed in 3.5.9-tuxcare.8.
- Record
CLSA-2026-1790900201- Updated
- 2026-11-02
OSVCLSA-2026-1794008495 No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
OSVROOT-APP-MAVEN-CVE-2026-50645 No score
CVE-2026-50645 in org.apache.cxf:cxf-core - Patched by Root
Root has patched CVE-2026-50645 in the org.apache.cxf:cxf-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-50645- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-coreMaven |
4.2.0 up to 4.2.2 | 4.2.2 |
org.apache.cxf:cxf-coreMaven |
4.0.0 up to 4.1.7 | 4.1.7 |
org.apache.cxf:cxf-coreMaven |
before 3.6.12 | 3.6.12 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 5 CVEs |
3.5.11 up to 3.5.11-tuxcare.9, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.73.5.11-tuxcare.8 |
3.5.11-tuxcare.9 |
org.apache.cxf:cxf-coreTuxCare:Maven |
3.5.9 up to 3.5.9-tuxcare.8, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9-tuxcare.63.5.9-tuxcare.73.5.9.tuxcare.1 |
3.5.9-tuxcare.8 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreMaven |
4.2.0 up to 4.2.2, plus listed versions 4.2.1 |
4.2.2 |
org.apache.cxf:cxf-coreMaven |
4.0.0 up to 4.1.7, plus listed versions 4.0.14.0.104.0.114.0.24.0.3 Show 13 moreShow less4.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.24.1.34.1.44.1.54.1.6 |
4.1.7 |
org.apache.cxf:cxf-coreMaven |
before 3.6.12, plus listed versions 3.0.03.0.0-milestone13.0.0-milestone23.0.13.0.10 Show 45 moreShow less3.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.6 |
3.6.12 |
org.apache.cxf:cxf-coreRoot:Maven |
before 4.0.11-aikido.1 | 4.0.11-aikido.1 |
io.root.org.apache.cxf:cxf-coreRoot:Maven |
before 4.0.11-root.io.1 | 4.0.11-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| facts | NVD | |
| affected, aliases | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50645 is a high vulnerability (CVSS 7.5) in Apache Cxf, published June 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in org.apache.cxf:cxf-core 4.2.2.
References
lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93
openwall.com/lists/oss-security/2026/06/11/12
nvd.nist.gov/vuln/detail/CVE-2026-50645
cxf.apache.org/security-advisories.data/CVE-2026-50645.txt
github.com/advisories/GHSA-ghvc-7hp8-2g2v
repo.maven.apache.org/maven2
Left out here: 52 versions. The JSON record has them.