GHSA-ghvc-7hp8-2g2v: Apache CXF: No restriction on attachment headers per message

Q: Who can exploit this issue?

An unauthenticated remote attacker can exploit it by sending a message that is deserialized by Apache CXF with an excessive number of attachment headers. The impact is uncontrolled resource consumption that can result in denial of service.

Q: Are default configurations affected?

Affected versions have no restriction on the number of attachment headers per deserialized message. The fixed releases impose a default maximum of 500 attachments per message.

Q: Which versions contain the fix?

Upgrade to Apache CXF 4.2.2, 4.1.7, or 3.6.12. These versions address the issue by applying the 500-attachment default limit.

Published Jun 12, 2026

Updated

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.

Affected Software

1 affected component

Apache CXF<4.2.2, <4.1.7, <3.6.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.2.2
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 4.1.7
Upgrade
Upgrade Apache CXF to a version that resolves this vulnerability.
Fixed in 3.6.12

Event History

Jun 12, 2026

CVE Published

via OSV·09:06 AM

Data Sourced

via OSV·09:06 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated remote attacker can exploit it by sending a message that is deserialized by Apache CXF with an excessive number of attachment headers. The impact is uncontrolled resource consumption that can result in denial of service.

Are default configurations affected?

Affected versions have no restriction on the number of attachment headers per deserialized message. The fixed releases impose a default maximum of 500 attachments per message.

Which versions contain the fix?

Upgrade to Apache CXF 4.2.2, 4.1.7, or 3.6.12. These versions address the issue by applying the 500-attachment default limit.

GHSA-ghvc-7hp8-2g2v: Apache CXF: No restriction on attachment headers per message

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default configurations affected?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default configurations affected?

Which versions contain the fix?