CLEANSTART-2026-CF61935: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (defau...
Security vulnerability affects the wso2am package. In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r4 - Configuration
Configure attachment-max-header-size to 300 characters.
Apache CXF multipart/MTOM attachment parser attachment-max-header-size = 300 - Configuration
Configure attachment-headers-max-count to 500.
Apache CXF multipart/MTOM attachment parser attachment-headers-max-count = 500
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates the issue is network-reachable, requires low attack complexity, and does not require privileges or user interaction.
Are default attachment-header limits sufficient to prevent this issue?
No. The affected parser did not fully enforce the configured limits, including the default attachment-max-header-size of 300 characters and attachment-headers-max-count of 500.
What is the expected security impact?
The reported impact is high availability impact, with no reported confidentiality or integrity impact.
Does the advisory identify affected package versions or a detection method?
No affected version range or method for determining whether an installation is already affected is provided in the available data.