Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
CVE-2026-107937
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107937
Apache CXF
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Apache Software Foundation",
"product": "Apache CXF",
"versions": [
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.4",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.0.0",
"lessThan": "4.1.9",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "3.6.13",
"versionType": "semver"
}
],
"packageURL": "pkg:maven/org.apache.cxf/cxf-core",
"packageName": "org.apache.cxf:cxf-core",
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-107937
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #29930 · Revision 1
- Added to Heist Feed
- Publisher date