CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

As cited

Copy frozen at 2026-10-09 13:24 UTC (site build).

vulnerabilities

CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

CVE-2026-107937 affects Apache CXF versions 4.2.0 before 4.2.4, 4.0.0 before 4.1.9, and before 3.6.13. The multipart/MTOM attachment header parser does not fully enforce configured size and count limits, allowing attackers to bypass protections through header fragmentation and exhaust server memory, resulting in denial of service.

Why it matters: Organizations running vulnerable Apache CXF versions face memory exhaustion attacks from remote actors sending specially crafted multipart requests; patching to the fixed versions is required to restore attachment header validation.

Source published

2026-10-09 10:27 UTC

First seen by Cybersecurity Tracker

2026-10-09 11:33 UTC