GHSA-ghvc-7hp8-2g2v: Apache cxf-core: No restriction on attachment headers per message

highCVSS 7.5CVE-2026-50645

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.

Details

Source: GitHub Security Advisories (INTL · database · site)
Severity: high — CVSS 7.5
Published: 2026-06-12
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://github.com/advisories/GHSA-ghvc-7hp8-2g2v

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-506450.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-50645	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[NEW] [medium] IBM WebSphere Application Server: Multiple vulnerabilities enable Denial of Servicecert-bund
medium[UPDATE] [medium] Apache CXF: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in IBM products (July 17, 2026)cert-fr-avis
unknownMultiple vulnerabilities in IBM products (July 10, 2026)cert-fr-avis
unknownMultiple vulnerabilities in IBM products (July 3, 2026)cert-fr-avis
unknownIBM WebSphere Products Multiple Vulnerabilitieshkcert

GHSA-ghvc-7hp8-2g2v: Apache cxf-core: No restriction on attachment headers per message

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from GitHub Security Advisories