Loading vulnerability…
Denial of Service via Excessive Attachment Headers in Apache CXF
CVE-2026-64958 is a denial-of-service vulnerability in Apache CXF's cxf-core component caused by an incomplete fix for CVE-2026-50645. Processing a message containing many attachment headers can still cause denial of service. Affected releases include Apache CXF 4.2.0 through 4.2.2, versions from 4.0.0 before 4.1.8, and 3.6.x versions before 3.6.12. The vulnerability is fixed in versions 4.2.3, 4.1.8, and 3.6.12.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can disrupt the availability of an affected Apache CXF service by submitting a message containing excessive attachment headers. Legitimate requests may be denied service. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-provided workaround is specified. Until updates can be installed, restrict access to affected services to trusted clients and apply request or attachment-header limits at an upstream gateway where supported. These compensating controls are not a substitute for the fix.
Patch, then assume compromise.
Upgrade Apache CXF to version 4.2.3, 4.1.8, or 3.6.12, as appropriate for the installed release line, or a later fixed release. For vendor-bundled deployments, install the applicable vendor update rather than independently replacing bundled libraries. Red Hat JBoss EAP 8.1 deployments should update to 8.1.9 using RHSA-2026:92057 for RHEL 8, RHSA-2026:92056 for RHEL 9, or RHSA-2026:92059 for RHEL 10. Apply relevant prerequisite errata and back up the installation before updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.