CVE-2026-50645: Apache cxf-core: No restriction on attachment headers per message

June 12, 2026 (updated August 12, 2026)

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue by imposing a maximum default of 500 attachments per message.

References

cxf.apache.org/security-advisories.data/CVE-2026-50645.txt
github.com/advisories/GHSA-ghvc-7hp8-2g2v
lists.apache.org/thread/24zb7cqcvykhwm0j797dmdq25s61mj93
nvd.nist.gov/vuln/detail/CVE-2026-50645

Code Behaviors & Features

Detect and mitigate CVE-2026-50645 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →