As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing
Apache MyFaces versions 2.2.0 through 4.1.3 contain a denial of service (DoS) vulnerability (CVE-2026-76646) in request parsing that allows an attacker to trigger excessive resource consumption through specially crafted request parameters. The issue is classified as critical severity across multiple affected version lines.
Why it matters: Organizations running vulnerable Apache MyFaces instances should apply patches immediately, as remote attackers can crash or degrade web application availability without authentication.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing
CVE-2026-76646 affects Apache MyFaces versions 2.2.0 through 4.1.3, allowing remote attackers to trigger excessive resource consumption through crafted request parameters and cause a denial of service condition. Organizations running affected versions should prioritize patching or applying mitigations to prevent disruption.
Why it matters: Teams managing Apache MyFaces deployments need to identify affected versions in production and apply updates, as remote attackers can exploit this without authentication to disrupt service availability.
- Source published
- First seen by Cybersecurity Tracker