CVE-2026-64958: Apache CXF: Denial of service via message header attachments
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 4.1.8 - Upgrade
Upgrade
Apache CXFto a version that resolves this vulnerability.Fixed in 3.6.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64958?
CVE-2026-64958 has a risk rating of 32, indicating a significant denial of service vulnerability.
How do I fix CVE-2026-64958?
To fix CVE-2026-64958, upgrade to Apache CXF version 4.2.3, 4.1.8, or 3.6.12.
What software is affected by CVE-2026-64958?
CVE-2026-64958 affects Apache CXF software.
What type of vulnerability is CVE-2026-64958?
CVE-2026-64958 is a denial of service vulnerability that can be exploited via message header attachments.
When was CVE-2026-64958 published?
CVE-2026-64958 was published on August 6, 2026.