https://seclists.org/oss-sec/2026/q3/809: CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded quest Parsing

Q: Which deployments should be treated as affected?

Apache MyFaces 2.2.0 through 2.2.15, 2.3.0 through 2.3.11, 3.0.0 through 3.0.3, 4.0.0 through 4.0.3, 4.1.0 through 4.1.3, and 2.3-next-* are affected. Older unsupported versions may also be affected.

Q: What does an attacker need to trigger the issue?

The attacker needs to be able to send specially crafted request parameters to the application remotely. The advisory does not state that authentication or any additional prerequisite is required.

Q: What versions resolve the issue?

Upgrade to Apache MyFaces 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4. These versions are identified as fixing the issue.

Published Sep 16, 2026

Updated

Affected Software

5 affected components

Apache MyFaces>=2.2.0<=2.2.15

Apache MyFaces>=2.3.0<=2.3.11

Apache MyFaces>=3.0.0<=3.0.3

Apache MyFaces>=4.0.0<=4.0.3

Apache MyFaces>=4.1.0<=4.1.3

Frequently Asked Questions

Which deployments should be treated as affected?

Apache MyFaces 2.2.0 through 2.2.15, 2.3.0 through 2.3.11, 3.0.0 through 3.0.3, 4.0.0 through 4.0.3, 4.1.0 through 4.1.3, and 2.3-next-* are affected. Older unsupported versions may also be affected.

What does an attacker need to trigger the issue?

The attacker needs to be able to send specially crafted request parameters to the application remotely. The advisory does not state that authentication or any additional prerequisite is required.

What versions resolve the issue?

Upgrade to Apache MyFaces 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4. These versions are identified as fixing the issue.

https://seclists.org/oss-sec/2026/q3/809: CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded quest Parsing

Affected Software

Frequently Asked Questions

Which deployments should be treated as affected?

What does an attacker need to trigger the issue?

What versions resolve the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be treated as affected?

What does an attacker need to trigger the issue?

What versions resolve the issue?