https://seclists.org/oss-sec/2026/q4/114: CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

Q: Which deployments are exposed?

Apache CXF deployments using affected versions are exposed when they process multipart/MTOM requests. The issue can be triggered remotely without authentication.

Q: Are the default attachment header limits sufficient protection?

No. The default attachment-max-header-size of 300 characters and attachment-headers-max-count of 500 can be bypassed through folded or repeated multipart part headers.

Q: What does an attacker need to send?

An attacker needs to send a multipart request containing very large headers constructed with continuation lines or repeated header lines. This can cause unbounded memory allocation and denial of service.

Q: Which versions contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. Affected releases are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and versions before 3.6.13.

Published Oct 9, 2026

Updated

Affected Software

1 affected component

Apache CXF>=4.2.0<4.2.4, >=4.0.0<4.1.9, <3.6.13

Frequently Asked Questions

Which deployments are exposed?

Apache CXF deployments using affected versions are exposed when they process multipart/MTOM requests. The issue can be triggered remotely without authentication.

Are the default attachment header limits sufficient protection?

No. The default attachment-max-header-size of 300 characters and attachment-headers-max-count of 500 can be bypassed through folded or repeated multipart part headers.

What does an attacker need to send?

An attacker needs to send a multipart request containing very large headers constructed with continuation lines or repeated header lines. This can cause unbounded memory allocation and denial of service.

Which versions contain the fix?

Upgrade to Apache CXF 4.2.4, 4.1.9, or 3.6.13. Affected releases are 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and versions before 3.6.13.