Описание
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Ссылки
- Mailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.6.12 (исключая)Версия от 4.0.0 (включая) до 4.1.8 (исключая)Версия от 4.2.0 (включая) до 4.2.3 (исключая)
Одно из
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*
EPSS
Процентиль: 34%
0.00407
Низкий
7.5 High
CVSS3
Дефекты
CWE-400
Связанные уязвимости
CVSS3: 7.5
github
2 дня назад
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
EPSS
Процентиль: 34%
0.00407
Низкий
7.5 High
CVSS3
Дефекты
CWE-400