CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

As cited

Copy frozen at 2026-09-17 01:51 UTC (site build).

vulnerabilities

CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache MyFaces versions 2.2.0 through 4.1.3 contain a denial of service (DoS) vulnerability (CVE-2026-76646) in request parsing that allows an attacker to trigger excessive resource consumption through specially crafted request parameters. The issue is classified as critical severity across multiple affected version lines.

Why it matters: Organizations running vulnerable Apache MyFaces instances should apply patches immediately, as remote attackers can crash or degrade web application availability without authentication.

Source published

2026-09-16 15:35 UTC

First seen by Cybersecurity Tracker

2026-09-16 17:33 UTC