{"id":"CVE-2026-64958","aliases":["CLSA-2026-1793898246","CLSA-2026-1793982274","CLSA-2026-1794008495","CLSA-2026-1794218709","EUVD-2026-53853","GHSA-3p6r-x275-5x98"],"status":"published","title":"Apache CXF: Denial of service via message header attachments","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00664,"percentile":0.52017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2026-08-06T10:13:04Z","modified":"2026-11-09T19:15:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.11"},{"fixed":"3.5.11-tuxcare.11"}]}],"versions":["3.5.11","3.5.11-tuxcare.1","3.5.11-tuxcare.10","3.5.11-tuxcare.2","3.5.11-tuxcare.3","3.5.11-tuxcare.4","3.5.11-tuxcare.5","3.5.11-tuxcare.6","3.5.11-tuxcare.7","3.5.11-tuxcare.8","3.5.11-tuxcare.9"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.9"},{"fixed":"3.5.9-tuxcare.12"}]}],"versions":["3.5.9","3.5.9-tuxcare.10","3.5.9-tuxcare.11","3.5.9-tuxcare.2","3.5.9-tuxcare.3","3.5.9-tuxcare.4","3.5.9-tuxcare.5","3.5.9-tuxcare.6","3.5.9-tuxcare.7","3.5.9-tuxcare.8","3.5.9-tuxcare.9","3.5.9.tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-integration-jca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-transports-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.2"}]}],"versions":["3.4.5","3.4.5-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-wsdl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.1"}]}],"versions":["3.0.12"],"bundled":7}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/trsnkxc2f21585zlt819blvchgl6oykb","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64958","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3p6r-x275-5x98"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64958.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-64958","title":"Apache CXF: Denial of service via message header attachments","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:13:04.069Z","modified":"2026-08-06T15:10:53.292Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-53853","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:13:04Z","modified":"2026-08-06T15:10:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:08.553271Z"}],"ghsa":[{"id":"GHSA-3p6r-x275-5x98","title":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of...","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T12:31:13Z","modified":"2026-08-06T18:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-64958","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T11:16:30.35Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-64958","title":"Apache CXF: Denial of service via message header attachments","description":"An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.","status":"published","published":"2026-08-06T10:13:04.069Z","modified":"2026-10-28T02:30:31.910219107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:14.096824Z"},{"id":"CLSA-2026-1793898246","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.11-tuxcare.11.","status":"published","published":"2026-11-05T18:04:07Z","modified":"2026-11-06T13:15:13.999108Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793982274","title":"TuxCare security update for org.apache.cxf (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 5 CVEs. Fixed in 3.5.9-tuxcare.12.","status":"published","published":"2026-11-06T17:24:35Z","modified":"2026-11-06T19:00:05.26274921Z","updated_at":"2026-11-06T19:05:31.753133Z"},{"id":"CLSA-2026-1794008495","title":"TuxCare security update for 8 packages (12 CVEs)","description":"TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.","status":"published","published":"2026-11-07T00:41:36Z","modified":"2026-11-07T07:15:03.24809114Z","updated_at":"2026-11-07T07:40:28.517244Z"},{"id":"CLSA-2026-1794218709","title":"TuxCare security update for org.apache.cxf (7 CVEs)","description":"TuxCare rebuilt 3 org.apache.cxf packages to address 7 CVEs. Fixed in 3.0.12-tuxcare.1.","status":"published","published":"2026-11-09T11:05:10Z","modified":"2026-11-09T19:15:02.890791072Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}