CVE-2026-50645
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack.
Risk Assessment
The organization may be vulnerable to attacks that could lead to system overload and service downtime.
Recommendation
Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.
Original NVD description (English source)
There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.